app-ledgr-eng[.]pages[.]dev

This domain operates as a fraudulent replica of the official Ledger Live wallet interface, designed to harvest cryptocurrency wallet credentials and recovery phrases. The site presents a near-identical login page titled 'Ledger Live Loginn | Simple, Secure & Fast Wallet Access,' targeting users who may overlook the misspelling in the page title. Visitors entering sensitive information risk immediate compromise of their digital assets, as the phishing infrastructure is configured to relay stolen credentials to attacker-controlled servers in real time. Analysis indicates the domain was registered on April 17, 2026, through Cloudflare, Inc., a registrar frequently exploited for its free hosting and privacy protections. The domain resolves to IP address 188.114.97.3, geolocated to Canada and associated with Cloudflare's content delivery network. Detection metrics reveal limited but critical coverage: only 3 out of 95 security vendors on VirusTotal currently flag the domain, while a single blocklist entry exists under PhishDestroy. The SSL certificate, issued by Google Trust Services (WE1), further obscures malicious intent by presenting a seemingly legitimate encryption layer. Users who have visited app-ledgr-eng.pages.dev or entered credentials should immediately revoke access to any connected wallets and transfer assets to new, secure addresses. All passwords and recovery phrases associated with the compromised account must be considered exposed and replaced. Enable multi-factor authentication on all cryptocurrency platforms and monitor transaction histories for unauthorized activity. Security teams are advised to block the domain and its resolving IP (188.114.97.3) at the network perimeter, as the site remains active and continues to pose a direct threat to Ledger users.