live-ledger-en-wallet[.]pages[.]dev

The domain live-ledger-en-wallet.pages.dev is assessed as an active brand impersonation page targeting Ledger users. The observed content is designed to simulate a legitimate wallet login environment, with the likely objective of collecting sensitive cryptocurrency credentials such as recovery phrases, private keys, or authentication data. Although current telemetry shows no detections on major engines, the behavioral intent aligns with credential harvesting commonly associated with fake wallet portals.

Technical intelligence indicates that the domain was created on May 27, 2026 and is hosted via Cloudflare Pages infrastructure. VirusTotal analysis reports 0/95 security vendors flagging the domain at the time of observation, indicating no automated detection coverage yet. Despite this, the domain is already listed on 1 security blocklist and has been blocked by PhishDestroy, suggesting external reputation-based or behavioral detection systems have identified malicious characteristics. The site remains in active status, increasing the likelihood of continued exposure to end users.

If a user has interacted with this domain, it is recommended to assume potential credential compromise risk. Users should avoid entering any seed phrases, private keys, or wallet passwords into the site. If information has already been submitted, affected wallet addresses should be considered compromised, and assets should be transferred immediately to a newly generated secure wallet. Additionally, users should revoke any connected session permissions, review system security for malware, and enable hardware wallet protection where possible. Continuous monitoring of related addresses and transaction activity is advised to mitigate potential financial loss.