lives-ledagr-en[.]pages[.]dev

The domain lives-ledagr-en.pages.dev has been confirmed as a brand impersonation phishing site targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live interface, specifically presenting a page titled 'Ledger Live | Secure Crypto Wallet.' This domain is currently offline, though it previously operated as an active threat vector for credential harvesting or crypto asset theft. Infrastructure analysis reveals the domain was created on March 23, 2026, and registered through Cloudflare, Inc. It resolves to the IP address 188.114.97.3, geolocated to Canada and associated with Cloudflare's network. Security vendor detection on VirusTotal shows 13 of 95 engines flagging the domain as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The combination of brand impersonation, low detection but non-zero blocklist presence, and Cloudflare-hosted infrastructure suggests a targeted campaign with elevated risk. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure changes. However, the threat actor may re-establish operations under a new domain or subdomain. Organizations and users are advised to block the domain and IP address 188.114.97.3 at perimeter security controls. Cryptocurrency wallet users should verify domain authenticity before entering credentials and enable multi-factor authentication where available. Security teams are recommended to monitor for similar patterns, including domains mimicking 'Ledger Live' or using Cloudflare Pages infrastructure with recent creation dates.