en-live[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically designed to mimic a cryptocurrency wallet management interface. Analysis indicates the site presents itself as 'Ledger Live - Secure Crypto Management,' a direct impersonation of the legitimate Across protocol and Ledger hardware wallet ecosystem, likely intended to facilitate crypto asset theft through credential harvesting or wallet-draining scripts. Infrastructure analysis reveals the domain en-live.pages.dev was registered on September 08, 2025, through Cloudflare, Inc. and resolves to the IP address 172.66.47.93, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common pattern observed in phishing infrastructure leveraging free-tier hosting. Detection metrics show 1 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist (PhishDestroy) and remains active at the time of assessment. Mitigation steps for this specific threat type include immediate blocking of the domain and IP at the network perimeter, particularly for endpoints handling cryptocurrency transactions. Organizations should deploy browser-based protections to prevent access to the domain and monitor for any attempts to visit en-live.pages.dev. End users should be advised to verify wallet interfaces by cross-referencing official documentation and never enter recovery phrases or private keys on untrusted platforms. Given the domain's recent registration and active status, continuous monitoring for related infrastructure (e.g., subdomains, redirect chains) is recommended to preempt further compromise attempts.