ledgr--live-en-us[.]pages[.]dev

This domain, ledgr--live-en-us.pages.dev, poses a direct threat as a cryptocurrency wallet impersonation site targeting Ledger users. The page mimics the official Ledger Live interface, presenting itself as the 'Ledger® Live Wallet – Getting Started™ Developer Portal™' to deceive victims into entering sensitive wallet credentials, recovery phrases, or private keys. Such attacks typically lead to immediate unauthorized access to cryptocurrency holdings, resulting in irreversible asset theft. The domain is designed to exploit trust in the Ledger brand, using visual and textual cues to appear legitimate, including the use of trademark symbols and a professional page layout. Analysis indicates this domain is hosted on Cloudflare infrastructure, resolving to IP address 172.66.44.104, with an SSL certificate issued by Google Trust Services (WE1). The domain was registered on April 30, 2026, and is currently flagged by 4 out of 95 security vendors on VirusTotal. It appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The creation date is notably in the future, suggesting potential manipulation of WHOIS data or a placeholder entry, which is a common tactic to evade detection or delay investigation. Users who have visited ledgr--live-en-us.pages.dev or entered any credentials on the site should immediately revoke access to any associated cryptocurrency wallets. All recovery phrases, passwords, and private keys exposed to this domain must be considered compromised. Affected users should transfer remaining assets to a new, secure wallet using an offline device and monitor all linked accounts for unauthorized transactions. It is recommended to report the incident to relevant cryptocurrency platforms and local cybersecurity authorities. Infrastructure analysis confirms the domain remains active, underscoring the urgency of remediation for any potential victims.