live-leedger-io[.]pages[.]dev

The domain live-leedger-io.pages.dev has been identified as an active phishing threat specifically targeting Ledger wallet users. This campaign impersonates the Ledger brand to deceive victims into revealing sensitive information. The threat remains under investigation as researchers continue to assess the scope and sophistication of the scam.

Technical analysis reveals that live-leedger-io.pages.dev is registered through Cloudflare, Inc. and secured with an SSL certificate issued by Google Trust Services, which may lend the appearance of legitimacy. The domain resolves to the IP address 172.66.44.238. VirusTotal scans show zero detections across 95 antivirus vendors, indicating the site is currently not flagged by traditional security engines. There is no available data on the domain’s creation date or blocklist count, but the clean VirusTotal score suggests the phishing kit may be newly deployed or evading detection.

Given the domain’s impersonation of Ledger—a high-value cryptocurrency hardware wallet provider—users should exercise heightened caution. PhishDestroy recommends immediate blocking of this domain in organizational environments and vigilance when interacting with unsolicited Ledger-related links. Users should verify Ledger communications through official channels only, and never enter credentials or recovery phrases on third-party web pages. Continuous monitoring and rapid response protocols are advised as the investigation progresses.