install-ledger-lives[.]pages[.]dev

PhishDestroy identifies install-ledger-lives.pages.dev as an active brand impersonation scam site targeting Ledger cryptocurrency wallet users. The domain is currently operational and leverages Ledger’s branding to deceive visitors into divulging sensitive information or transferring funds to attacker-controlled wallets. This domain was flagged by 3 of 95 VirusTotal security vendors, registered via Cloudflare, Inc., and resolves to IP address 172.66.44.249 with a Google Trust Services SSL certificate. The exact VirusTotal detection count is 3 detections out of 95 engines as of the latest scan. The domain is a Cloudflare Pages static site, a common tactic to rapidly deploy fraudulent pages while evading takedown efforts. Given the use of Cloudflare’s infrastructure and a valid TLS certificate, the site appears legitimate at first glance, increasing its potential to bypass user skepticism. The active status indicates ongoing malicious operations, with no confirmed date of creation or blocklist count available in current feeds. As of this assessment, install-ledger-lives.pages.dev remains active and poses a high risk to cryptocurrency users, particularly those familiar with Ledger’s branding. It is strongly recommended to block this domain at the network and DNS levels across all endpoints. Users should verify URLs through official Ledger channels before engaging and consider disallowing access to untrusted or newly registered domains. Report suspicious activity to Ledger’s security team and update threat intelligence feeds to include this domain. Avoid visiting or interacting with this site to prevent potential credential theft or cryptocurrency loss.