en-live--ledgr-us[.]pages[.]dev

The domain en-live--ledgr-us.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Ledger, a cryptocurrency wallet provider. It posed as the legitimate Ledger Live platform to deceive users into entering sensitive information, likely for cryptocurrency-related fraud. No drainer kit was identified, but the site was actively used for cryptocurrency scams. As of the latest verification, en-live--ledgr-us.pages.dev has been taken offline.

Technical indicators confirm the malicious nature of en-live--ledgr-us.pages.dev. The domain was flagged by 2 of 95 security vendors on VirusTotal, including LevelBlue and Phishing Database, and appeared on 1 security blocklist (PhishDestroy). It was registered through Cloudflare, Inc. on September 24, 2025, and resolved to the IP address 188.114.97.3, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Ledger Live | Secure Crypto Wallet'. The site employed technologies such as HSTS, Cloudflare, and HTTP/3, and returned an HTTP 403 status when accessed. Gridinsoft assigned it a trust score of 0/100.

Users who interacted with en-live--ledgr-us.pages.dev should immediately revoke any token approvals and transfer cryptocurrency funds to a new wallet to prevent unauthorized access. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Monitor accounts for suspicious activity and report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand (Ledger) to aid in takedown efforts.