wallets-lives-io[.]pages[.]dev

This domain, wallets-lives-io.pages.dev, is under investigation for brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The site presents itself as the Ledger Live Wallet developer portal, using the page title 'Ledger® Live Wallet – Getting Started™ | Developer Portal' to deceive users into believing they are accessing legitimate Ledger resources. No direct evidence of a crypto drainer kit has been identified at this stage, but the domain exhibits characteristics consistent with credential harvesting or fraudulent software distribution aimed at cryptocurrency users. Analysis indicates the domain has a VirusTotal detection score of 0/95, suggesting it has not yet been widely flagged by security vendors. It is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.52. The domain was created on May 01, 2026, which may indicate an attempt to appear legitimate through a future-dated registration. It appears on one security blocklist and has a Gridinsoft trust score of 0/100. The SSL certificate is issued by Google Trust Services, and the infrastructure is hosted behind Cloudflare, utilizing technologies such as HSTS and HTTP/3. No detections were recorded in Google Safe Browsing at the time of analysis. The domain is currently offline, having been taken down following its identification as a phishing threat. Despite its inactive status, residual risk remains due to the potential for the infrastructure to be reactivated or repurposed. Users who may have interacted with the domain are advised to verify their systems for unauthorized access, reset credentials associated with Ledger or cryptocurrency accounts, and monitor for signs of compromise. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts. Continuous monitoring of related infrastructure is recommended to detect any resurgence of malicious activity.