ledger--live-us[.]pages[.]dev

PhishDestroy identifies ledger--live-us.pages.dev as a fraudulent domain actively impersonating the Ledger brand, posing a credible threat to cryptocurrency users. This domain is currently under investigation but remains active, leveraging deceptive branding to deceive visitors into divulging sensitive credentials or financial information. The threat profile is classified as brand impersonation, a high-risk tactic frequently employed in credential harvesting and malware distribution campaigns targeting crypto investors. This domain resolves to IP address 172.66.47.11 and operates under Cloudflare, Inc. registration, utilizing a Google Trust Services SSL certificate to enhance its appearance of legitimacy. VirusTotal analysis shows 2 out of 95 detection engines flagging the domain, indicating it has not yet been widely recognized as malicious. The domain is hosted on pages.dev, a legitimate service from Cloudflare, which is commonly abused in phishing campaigns due to its free and fast deployment capabilities. Despite its lack of blocklist presence, the combination of brand impersonation, recent deployment, and SSL encryption creates a deceptive surface that may evade user scrutiny and automated defenses. To mitigate exposure to this threat, users should avoid interacting with ledger--live-us.pages.dev and verify the authenticity of all Ledger-related domains by visiting the official website directly. Organizations are advised to block this domain at the DNS and firewall levels and monitor for any associated IP traffic. Security teams should also update threat intelligence feeds with this indicator to enhance proactive detection. Given the domain’s active status and low detection rate, immediate action is recommended to prevent potential compromise.