live-ledgar-io-us[.]pages[.]dev

This domain is actively impersonating Ledger, a hardware wallet provider, to deploy crypto drainer malware. The site presents itself as "Ledger Live Wallet — Technical Edition with Ledger®," a fraudulent version of the legitimate Ledger Live application. Analysis indicates the infrastructure is designed to harvest wallet credentials and execute unauthorized transactions, directly targeting cryptocurrency holdings of visitors who interact with the site. The threat extends beyond credential theft, as the site likely includes malicious scripts to drain funds from connected wallets without user consent. Infrastructure analysis reveals the domain live-ledgar-io-us.pages.dev was registered through Cloudflare Pages on April 11, 2026, and currently resolves to the IP address 188.114.96.3, hosted by Cloudflare, Inc. in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted sites. Security vendors have flagged this domain, with 12 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on one security blocklist, and its active status confirms the threat remains operational. The page title and branding closely mimic Ledger’s official materials, increasing the likelihood of successful deception. Users who visited this domain should immediately disconnect any connected wallets and revoke access to all decentralized applications (dApps) linked through the site. It is critical to transfer remaining funds to a new, secure wallet using a different device to mitigate potential compromise. Monitor all wallet addresses for unauthorized transactions and report the incident to relevant security teams or platforms. If credentials were entered, assume they are compromised and avoid reusing them across other services. Organizations should update blocklists to include this domain and its associated IP address to prevent further exposure.