serch-ledgr--live[.]pages[.]dev

The domain serch-ledgr--live.pages.dev is identified as a brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates this domain mimics the official LedgerLive platform to deceive users into disclosing sensitive credentials, including wallet recovery phrases and private keys. The current status of the domain is offline, though it remains a documented indicator of compromise. Infrastructure analysis reveals the domain was registered on September 25, 2025, through Cloudflare, Inc. and resolves to the IP address 188.114.97.3. Security vendors have flagged this domain, with 7 out of 95 VirusTotal engines detecting malicious activity. The site appears on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. The SSL certificate is issued by Google Trust Services, and the page title, "Official Site®® | LedgerLive® | Getting Started®™," explicitly impersonates Ledger’s branding. Technologies detected include HSTS, Cloudflare, and HTTP/3, which may be leveraged to enhance the appearance of legitimacy. Given the elevated risk posed by this domain, users are advised to verify the authenticity of any Ledger-related communications or websites before interacting with them. Organizations should update their blocklists to include this domain and its associated IP address. If credentials were entered on this site, affected users should immediately transfer assets to a secure wallet, revoke any compromised permissions, and monitor accounts for unauthorized transactions. Security teams are encouraged to review logs for connections to 188.114.97.3 and the domain serch-ledgr--live.pages.dev to identify potential compromises.