app-live-ledgr-app[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically targeting Ledger, a cryptocurrency hardware wallet provider. The site mimics the official Ledger Live application interface, presenting itself as a legitimate platform for managing crypto and Web3 assets under the page title 'Ledger Live App – Securely Manage Crypto & Web3.' Such impersonation tactics are commonly employed to harvest credentials, private keys, or deploy malicious software on victims' devices. Infrastructure analysis reveals the domain app-live-ledgr-app.pages.dev was registered through Cloudflare, Inc. on April 28, 2026, and currently resolves to the IP address 188.114.96.3, geolocated to Canada under Cloudflare's network. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 3 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, identified as WE1, which may lend an appearance of legitimacy to unsuspecting users. Despite these detections, the domain remains active at the time of this assessment. Mitigation against this threat involves several technical and procedural controls. Users should verify domain authenticity by cross-referencing official communications from the targeted brand, avoiding interaction with unsolicited links. Network-level protections, such as DNS filtering or endpoint detection rules, should be configured to block known malicious domains and IPs, including 188.114.96.3. Security teams are advised to monitor for indicators of compromise, such as unexpected SSL certificates or anomalous traffic to the identified infrastructure. Additionally, multi-factor authentication and hardware-based security keys should be enforced for all cryptocurrency-related accounts to reduce the risk of credential theft.