leadger-live-us-in[.]pages[.]dev

This domain, leadger-live-us-in.pages.dev, is a confirmed phishing site designed to impersonate Ledger Live, the official interface for Ledger hardware wallets. The site mimics the legitimate Ledger Live platform, presenting itself as a "Getting Started" guide to deceive users into entering sensitive information such as wallet credentials, recovery phrases, or private keys. Given the nature of cryptocurrency transactions, victims who fall for this scheme risk immediate and irreversible loss of funds, as stolen recovery phrases can be used to gain full access to their wallets without physical device verification. Analysis indicates this domain was registered on April 30, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.140. The site employs an SSL certificate issued by Google Trust Services, creating a false sense of security for visitors. Despite its professional appearance, the domain is flagged by 9 out of 95 security vendors on VirusTotal, including detection as a phishing threat. Additional technical indicators include the use of HSTS and HTTP/3 protocols, which are commonly leveraged by threat actors to evade detection and enhance the site's perceived legitimacy. The domain is currently offline but remains a documented part of phishing infrastructure targeting Ledger users. If you visited leadger-live-us-in.pages.dev or entered any sensitive information, immediate action is required. First, disconnect the affected device from the internet to prevent further data transmission. Next, assume all entered credentials or recovery phrases are compromised and transfer any remaining assets from the associated wallet to a new, secure wallet using a different recovery phrase. Monitor all linked accounts for unauthorized transactions and enable additional security measures such as two-factor authentication where available. Report the incident to the legitimate Ledger support team and consider filing a report with local cybercrime authorities to aid in tracking the threat actors behind this infrastructure.