ledger-livee-wallet[.]pages[.]dev

This domain, ledger-livee-wallet.pages.dev, is flagged for brand impersonation phishing targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to deceive users into entering sensitive wallet credentials or recovery phrases, likely functioning as a crypto drainer. The elevated risk level stems from the direct financial threat posed by such infrastructure, which can lead to irreversible asset theft if users interact with the malicious interface. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on September 09, 2025, and resolves to the IP address 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for phishing sites leveraging legitimate CDN services. VirusTotal detections show 11 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The page title, 'Suspected phishing site | Cloudflare,' suggests the hosting provider may have intervened to suspend the content, though the domain remains technically active. Mitigation against such threats requires heightened user awareness and technical controls. Users should verify domain authenticity by cross-referencing official Ledger communication channels and avoiding interaction with unsolicited links. Organizations should implement DNS filtering to block known malicious domains and monitor for newly registered lookalike domains targeting financial or crypto-related brands. Given the domain's recent creation and association with Cloudflare Pages, security teams should investigate historical resolutions and SSL certificate issuances for similar patterns. If user exposure is suspected, immediate revocation of wallet access and migration to new recovery phrases is critical to prevent asset compromise.