began-live-ledger-app-io-us[.]pages[.]dev

PhishDestroy identifies began-live-ledger-app-io-us.pages.dev as a malicious domain currently active and engaged in brand impersonation targeting the cryptocurrency wallet provider Ledger.

The domain is currently under investigation as an active brand impersonation campaign. It has not yet been flagged by any of the 95 VirusTotal scanning vendors, suggesting it employs recently registered infrastructure or evasion techniques to avoid detection. This domain resolves to IP address 188.114.96.3 and is served over HTTPS via a certificate issued by Google Trust Services, leveraging Cloudflare’s CDN to obscure hosting details. While the domain name mimics Ledger’s official branding through a subdomain under pages.dev, the use of .pages.dev (a legitimate Cloudflare Pages domain) complicates quick identification by casual users.

Began-live-ledger-app-io-us.pages.dev demonstrates clear intent to deceive users seeking legitimate Ledger applications. It is currently unlisted on any known threat intelligence blocklists at this time. The domain’s registration through Cloudflare, combined with its use of a Google-validated SSL certificate, enhances its appearance of legitimacy. Given that Ledger is a frequent target in cryptocurrency phishing campaigns, this domain likely aims to harvest user credentials or seed phrases through a fraudulent application interface. PhishDestroy advises users to avoid interacting with this domain or any linked interfaces. If you encountered this domain, do not enter sensitive information. Organizations are recommended to block both the domain and the associated IP (188.114.96.3) at the network perimeter, and report this domain to Ledger’s abuse team and relevant threat intelligence platforms for proactive takedown.