portal-guide-ledgr[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Ledger users. Analysis indicates the site mimics the official Ledger Live login portal, attempting to harvest cryptocurrency wallet credentials and recovery phrases. The specific threat involves credential theft through a fraudulent interface designed to deceive users into entering sensitive authentication details. Infrastructure analysis reveals the domain portal-guide-ledgr.pages.dev was registered through Cloudflare, Inc. on April 30, 2026, and resolves to IP address 172.66.44.134 (Cloudflare, Inc., Canada). The SSL certificate is issued by Google Trust Services (WE1). The domain appears on one security blocklist and is flagged by 5 out of 95 security vendors on VirusTotal. The page title, 'Ledger Live Login - Secure Access to Your Crypto Assets,' directly impersonates the legitimate Ledger platform, increasing the likelihood of successful deception. To mitigate risks, network administrators should block the domain and IP address 172.66.44.134 at the firewall or DNS level. Users should verify domain authenticity by cross-checking URLs with the official Ledger website and avoid entering credentials on untrusted pages. Multi-factor authentication (MFA) and hardware wallet verification should be enforced for all cryptocurrency transactions. Organizations should monitor for similar impersonation domains using the seed pattern 'd25546' and update detection rules to include this threat cluster.