live-ledger-page[.]pages[.]dev

This domain, live-ledger-page.pages.dev, is flagged as a high-severity brand impersonation resource targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site masquerades as the official Ledger Developer Portal, presenting a page titled 'Ledger Live Integrations - Ledger Developer Portal' to deceive users into interacting with malicious crypto drainer infrastructure. The impersonation extends to visual and functional elements designed to harvest wallet credentials or execute unauthorized transactions, a tactic commonly associated with cryptocurrency theft operations. Infrastructure analysis reveals the domain was registered on April 18, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, geolocated to Canada and associated with Cloudflare’s network. Detection metrics show the domain is flagged by 9 out of 95 security vendors on VirusTotal, while appearing on one additional security blocklist. The SSL certificate is issued by Google Trust Services under the WE1 root, a common configuration for both legitimate and malicious Cloudflare-hosted pages. No Google Safe Browsing (GSB) detections are currently recorded, though this absence does not correlate with safety due to the domain’s recent deployment and targeted nature. As of the latest assessment, live-ledger-page.pages.dev remains active and continues to host the impersonation content. The domain’s Cloudflare registration and hosting infrastructure provide operational resilience, complicating takedown efforts. Users are advised to treat any interaction with this domain as a direct threat to cryptocurrency assets. Verification of Ledger-related communications should be conducted exclusively through the official ledger.com domain or verified developer portals. The persistence of this campaign underscores the necessity for heightened scrutiny of crypto-related web resources, particularly those hosted on content delivery networks or free-tier hosting platforms.