ledger-live-wallat[.]pages[.]dev

Domain ledger-live-wallat.pages.dev has been identified as a confirmed brand impersonation site actively mimicking the Ledger cryptocurrency wallet application. This malicious domain is currently live and distributing fraudulent content designed to deceive users into downloading counterfeit wallet software or exposing sensitive credentials. The threat actor behind this campaign is leveraging the trust associated with Ledger’s brand to propagate a high-risk deception targeting cryptocurrency users.

PhishDestroy identifies this domain as posing a significant security risk. It was flagged by 1 of 95 VirusTotal vendors on inspection. The domain resolves to IP address 172.66.44.196 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services. The page targets the Ledger brand with a typo-infused name variant, 'ledger-live-wallat.pages.dev', likely intended to bypass detection filters. This domain remains active and unblocked by major threat intelligence platforms at the time of analysis.

Given the confirmed impersonation of a globally recognized financial brand and the observed infrastructure alignment with known phishing hosting providers, the risk level for this domain is elevated. Users must refrain from downloading any applications or entering credentials via this domain. Recommendations include blocking the domain at the DNS and network levels, inspecting endpoint activity for related artifacts, and educating users to verify software sources exclusively through Ledger’s official website or verified app stores. Continuous monitoring for new instances and takedown requests is advised to mitigate potential credential theft or malware delivery.