ldgres-live-emg[.]pages[.]dev

The domain ldgres-live-emg.pages.dev is currently active and engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates this domain is functioning as a crypto drainer, designed to deceive users into disclosing sensitive credentials or authorizing malicious transactions under the guise of the legitimate Ledger Live platform. The page title, 'Ledger Live Wallet — Technical Edition,' reinforces the deception by mimicking official Ledger branding and terminology. Infrastructure analysis reveals the domain was registered on April 27, 2026, through Cloudflare Pages, a platform commonly exploited for rapid deployment of phishing infrastructure. The domain resolves to the IP address 172.66.44.65, geolocated in Canada and associated with Cloudflare, Inc. As of the latest assessment, the domain is flagged by 3 of 95 security vendors on VirusTotal, indicating limited but growing detection. It appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often leveraged to lend credibility to malicious sites. Current monitoring confirms the domain remains operational, posing a high risk to users unfamiliar with Ledger’s official domains and authentication processes. Organizations and individuals are advised to implement immediate network-level blocking of 172.66.44.65 and the domain ldgres-live-emg.pages.dev. Endpoint protection systems should be updated to recognize the domain and associated indicators of compromise. Users should verify all Ledger-related communications via official channels and avoid interacting with unsolicited links or prompts requesting wallet access or recovery phrases. Enhanced scrutiny of SSL certificates and page titles is recommended to identify similar impersonation attempts.