ledger-live-login-ksa[.]pages[.]dev

This domain, ledger-live-login-ksa.pages.dev, is identified as a credential harvesting phishing site specifically designed to impersonate Ledger, a hardware cryptocurrency wallet provider. The site mimics legitimate Ledger login interfaces to deceive users into entering sensitive wallet credentials, recovery phrases, or private keys, which attackers can then exploit to gain unauthorized access to cryptocurrency assets. Infrastructure analysis reveals the use of Cloudflare Pages hosting, a common tactic to obscure the true origin of malicious content while leveraging Cloudflare’s SSL encryption to appear legitimate. Evidence supporting this assessment includes detection by 9 out of 95 security vendors on VirusTotal, indicating a high confidence level in its malicious nature. The domain was registered on September 11, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, associated with Cloudflare’s network (AS13335). The domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), further masks its fraudulent intent under the guise of secure communication. The page title, 'Suspected phishing site | Cloudflare,' corroborates its deceptive infrastructure. Users who visited ledger-live-login-ksa.pages.dev should immediately assume their credentials or recovery phrases may have been compromised. It is critical to cease all interaction with the domain and revoke any entered credentials by resetting Ledger wallet access through official channels. Additionally, users should monitor their cryptocurrency wallets for unauthorized transactions and enable multi-factor authentication where available. If private keys or recovery phrases were exposed, transferring assets to a new, secure wallet is strongly advised to prevent theft. This domain’s elevated risk level underscores the need for heightened vigilance and proactive security measures.