get-ledgrlive-app[.]pages[.]dev

PhishDestroy identifies the domain get-ledgrlive-app.pages.dev as an active Ledger hardware wallet impersonation campaign, currently leveraging brand deception to distribute malicious payloads or harvest credentials. This domain, registered under Cloudflare Inc., masquerades as an official Ledger service to exploit user trust in cryptocurrency security solutions. The threat is classified as elevated due to the immediate risk of financial compromise for cryptocurrency users who may inadvertently engage with this fraudulent interface. This domain was flagged by 1 of 95 VirusTotal security vendors, indicating low but notable detection coverage. It resolves to IP address 188.114.97.3 and operates under a Google Trust Services SSL certificate, which may lend an air of legitimacy to unsuspecting victims. The domain is hosted on Cloudflare Pages, a platform often abused by threat actors for rapid deployment and evasion of takedown efforts. While the exact registration date remains unverified in public records, the presence of this domain in threat intelligence feeds suggests recent activation. Current blocklist counts and historical reputation scores remain undisclosed in open sources, but the combination of low VirusTotal detection and Cloudflare hosting warrants immediate scrutiny. Users are strongly advised to avoid interacting with get-ledgrlive-app.pages.dev or any domains resembling official Ledger services not hosted on ledger.com. Block the IP address 188.114.97.3 at the network perimeter and consider DNS sinkholing for associated domains. Ledger customers should verify any communications via official channels and enable hardware wallet transaction verification to prevent unauthorized fund transfers. Security teams are recommended to ingest this IOC into SIEM systems and conduct retrospective analysis for any internal DNS resolutions to this domain. Immediate takedown requests should be submitted to Cloudflare and Google Trust Services to mitigate ongoing exposure.