io-ledgrlive-app[.]pages[.]dev

The domain io-ledgrlive-app.pages.dev is currently flagged as an active brand impersonation threat specifically targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis confirms the domain is designed to mimic the official Ledger Live application interface, with the page title explicitly set to 'Ledger Live App - Secure Crypto Management.' This domain remains operational and poses a high risk to users who may unknowingly interact with it, believing it to be legitimate. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 24, 2026, and resolves to the IP address 188.114.96.3, hosted in Canada under Cloudflare's network. The SSL certificate is issued by Google Trust Services, identified by the serial number WE1. Detection metrics indicate the domain is flagged by 4 of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. Despite these indicators, the domain remains active and unmitigated as of this report. The technical indicators and current status of io-ledgrlive-app.pages.dev suggest a deliberate attempt to deceive users into disclosing sensitive information or installing malicious software. Users and organizations are strongly advised to block this domain at the network level and update endpoint protection rules to include the IP address 188.114.96.3. Security teams should monitor for any outbound connections to this domain or its associated IP, particularly in environments where cryptocurrency-related activities occur. Immediate user education is recommended to warn against interacting with unofficial Ledger domains, especially those hosted on non-standard top-level domains or content delivery networks.