ledger-live-wsq[.]pages[.]dev

This domain is classified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The site presents itself as the official Ledger Live application interface, designed to deceive users into entering sensitive credentials or installing malicious software. Analysis indicates the threat type aligns with credential harvesting and potential crypto asset compromise, given the targeted brand and page content. Infrastructure analysis reveals the domain ledger-live-wsq.pages.dev was registered on May 20, 2026, through Cloudflare, Inc. It resolves to the IP address 172.66.47.87, geolocated in Canada under Cloudflare’s network. VirusTotal detection shows 10 out of 95 security vendors have flagged this domain as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The page title, 'Ledger Live App – Manage Your Crypto Safely & Seamlessly,' closely mimics legitimate branding to enhance credibility. Mitigation requires immediate blocking of the domain and associated IP (172.66.47.87) at network and endpoint levels. Security teams should deploy indicators of compromise (IOCs) across monitoring systems, including the domain, IP, and SSL certificate details. Users should be alerted to verify official download sources via Ledger’s verified channels only. Multi-factor authentication (MFA) and hardware-based verification should be enforced for all cryptocurrency transactions to prevent unauthorized access resulting from credential theft.