ledgr-live-walet[.]pages[.]dev

Analysis of the domain ledgr-live-walet.pages.dev indicates active brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on April 4, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.214. The page title, 'Ledger Live (Official) — Secure Bitcoin & Crypto Wallet,' explicitly mimics Ledger's official branding, and the site is classified as a seed-phrase phishing kit, a technique commonly used to harvest cryptocurrency wallet credentials. Infrastructure review reveals the domain is hosted on Cloudflare's content delivery network, a frequent choice for phishing campaigns due to its ease of deployment and SSL certificate provisioning. The SSL certificate is issued by Google Trust Services, which does not inherently validate the legitimacy of the site's content. Detection data shows the domain appears on one security blocklist, and nine of 95 security vendors on VirusTotal have flagged it as malicious. The domain remains active as of July 12, 2026, with no evidence of takedown or remediation. Defenders should prioritize blocking this domain at the network and endpoint levels, particularly in environments where cryptocurrency-related services are accessed. The use of a seed-phrase phishing kit suggests the campaign is designed to capture sensitive wallet recovery phrases, enabling unauthorized access to victims' cryptocurrency holdings. Given the high-risk classification and confirmed malicious activity, organizations should treat this domain as a credible threat and monitor for related indicators of compromise. Further investigation into the hosting infrastructure may reveal additional linked domains or campaigns.