ledgerrlive-connect[.]pages[.]dev

PhishDestroy identifies ledgerrlive-connect.pages.dev as an active brand impersonation threat targeting Ledger users through a fake Ledger Live Desktop portal. This fraudulent site employs a page title identical to the official secure portal for crypto management, attempting to deceive visitors into believing it is the legitimate Ledger Live interface. By mimicking the branding and functionality of a trusted cryptocurrency wallet service, the domain aims to harvest login credentials, private keys, or other sensitive financial data under the guise of legitimate crypto management.

This domain resolves to IP 172.66.47.87 and is registered through Cloudflare, Inc., leveraging Google Trust Services for its SSL certificate to appear authentic. VirusTotal currently shows 0 detections out of 95 scans, meaning no security engines have flagged it as malicious at this time. The threat remains under active investigation but continues to operate, posing a significant risk to users who may unknowingly access it. The domain’s use of a Cloudflare-hosted pages.dev subdomain further obscures its malicious nature, blending in with legitimate developer or corporate resources.

Users who visited ledgerrlive-connect.pages.dev should immediately cease any interaction with the site and avoid entering any credentials or personal information. If credentials were entered, users must change their Ledger account passwords immediately and enable two-factor authentication if not already active. Additionally, revoke any cryptocurrency wallet permissions granted to the site and scan connected devices for malware. Report the domain to Ledger’s official support channels and consider using a reputable ad-blocker or DNS filtering service to block known malicious domains. Stay vigilant for unusual transactions or account activity, as compromised credentials may lead to unauthorized access or fund theft.