leddgger--lives[.]pages[.]dev

This domain is flagged for brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The threat type involves fraudulent support pages designed to harvest user credentials, recovery phrases, or install malicious software under the guise of legitimate wallet assistance. Analysis indicates an elevated risk level due to the domain's convincing mimicry of official Ledger infrastructure and its active distribution in phishing campaigns. Infrastructure analysis reveals the domain leddgger--lives.pages.dev was registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. It was created on April 30, 2026, though this date may reflect spoofed registration metadata. The domain appears on one security blocklist and is flagged by 11 out of 95 security vendors on VirusTotal. Additional technical indicators include the use of HTTP/3 and HSTS, alongside a Google Trust Services SSL certificate. The page title, 'Ledger® Live: Getting Started - Ledger Support®,' closely mirrors legitimate Ledger branding. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.97.3) across all network security controls. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems, including the domain, IP, and associated SSL certificate fingerprint. Users who interacted with the domain must reset Ledger Live credentials and verify wallet integrity by checking transaction histories for unauthorized activity. Security teams should monitor for follow-up phishing attempts, as brand impersonation domains often reappear under altered names or subdomains. Cryptocurrency holders are advised to access official support channels exclusively via verified Ledger URLs and enable multi-factor authentication where available.