official-ledger-live-en[.]pages[.]dev

PhishDestroy identifies the domain official-ledger-live-en.pages.dev as actively impersonating the Ledger brand. This site is categorized as a credential theft page designed to harvest cryptocurrency wallet credentials under the guise of the official Ledger Live Wallet app. The page title mimics legitimate branding, reinforcing deception. This represents a significant risk to users who may unknowingly input recovery phrases, private keys, or account passwords into the fraudulent interface. The campaign is ongoing and has not been neutralized. Users are urged to verify URLs and avoid entering sensitive information into untrusted web forms. This domain was flagged through multiple indicators. It leverages Cloudflare, Inc. as the domain registrar with resolution to IP address 172.66.44.210. The SSL certificate is issued by Google Trust Services, which provides no assurance of legitimacy. VirusTotal currently reports 0 detections out of 95 scanners, indicating a novel or evasive threat not yet widely recognized by security vendors. There is no evidence of this domain appearing on major blocklists such as Google Safe Browsing, PhishTank, or OpenPhish at this time. These characteristics suggest a targeted, low-detection campaign likely designed to bypass automated defenses. The domain remains active and accessible. Mitigation for this brand impersonation threat requires immediate user caution and defensive actions. Users should never download Ledger software from third-party sites or follow links in unsolicited messages. Always obtain software directly from the official Ledger website (ledger.com) or verified app stores. If credential exposure is suspected, immediately transfer assets to a new wallet, revoke any entered recovery phrases, and enable two-factor authentication. Organizations should deploy DNS filtering to block known malicious domains and monitor for traffic to pages.dev subdomains. Report suspicious domains to Ledger’s abuse team and relevant cybersecurity platforms to aid in global takedown efforts. Staying vigilant against impersonation scams remains critical as threat actors continue to exploit legitimate-seeming platforms like Pages.dev to host fraudulent crypto interfaces.