ledgr-li-ve[.]pages[.]dev

This domain, ledgr-li-ve.pages.dev, is flagged as a high-risk brand impersonation threat specifically targeting Ledger, a well-known hardware wallet provider. Analysis indicates the site mimics the official Ledger Live application, presenting itself as a secure crypto management hub to deceive users into interacting with malicious infrastructure. The page title, 'Ledger Live – Secure Crypto Management App | The Ultimate Hub for Digital Assets,' directly replicates legitimate branding, increasing the likelihood of user trust and subsequent compromise. No direct evidence of a crypto drainer kit was identified, but the domain's structure and content strongly suggest intent to facilitate asset theft or credential harvesting. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was created on April 30, 2026, and resolves to the IP address 172.66.47.190, hosted through Cloudflare. It is registered under Cloudflare, Inc., and employs an SSL certificate issued by Google Trust Services. Google Safe Browsing has flagged the domain with a 'SOCIAL_ENGINEERING' classification, and it appears on at least one security blocklist. VirusTotal reports 12 out of 95 security vendors detecting the domain as malicious, with technologies such as Tailwind CSS, HSTS, and HTTP/3 further indicating an attempt to appear legitimate while masking malicious intent. As of the latest assessment, ledgr-li-ve.pages.dev has been taken offline, likely in response to detection and blocking by security providers. Despite its current inactive status, the domain's historical activity and technical indicators warrant continued vigilance. Users who may have interacted with the site are advised to revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and verify the authenticity of any Ledger-related communications. The remaining risk includes potential reuse of the domain or migration of the threat to alternative infrastructure, emphasizing the need for ongoing monitoring of related indicators of compromise.