ledger-live-ash[.]pages[.]dev

This domain, ledger-live-ash.pages.dev, operates as a credential harvesting site specifically targeting Ledger hardware wallet users. Analysis indicates the site was designed to mimic the official Ledger Live interface, likely to capture seed phrases, private keys, or login credentials from victims attempting to access their cryptocurrency wallets. The domain's infrastructure and naming convention closely resemble legitimate Ledger services, increasing the likelihood of successful deception among users seeking wallet management tools.

Infrastructure analysis reveals the domain was registered on September 8, 2025, through Cloudflare, Inc. and currently resolves to the IP address 188.114.97.3, associated with Cloudflare's network (AS13335). The site appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Google Trust Services (WE1), follows standard practices but does not mitigate the malicious intent. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare's automated systems may have identified and flagged the content prior to its takedown.

Users who visited ledger-live-ash.pages.dev should immediately revoke any permissions granted to wallet applications linked to the site. If credentials, seed phrases, or private keys were entered, affected wallets must be considered compromised. Users should transfer remaining assets to a new wallet with a fresh seed phrase and monitor transaction histories for unauthorized activity. Additionally, all passwords and authentication tokens associated with Ledger or cryptocurrency services should be reset from a secure device. No further interaction with the domain should occur, even if it appears inactive.