liveledge-live[.]pages[.]dev

This domain, liveledge-live.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live platform, presenting a page titled 'Ledger Live - Secure Crypto Management' to deceive users into entering sensitive credentials, likely for wallet-draining attacks. No specific drainer kit has been conclusively identified, but the infrastructure aligns with known crypto-phishing campaigns. Infrastructure analysis reveals the domain was registered on March 24, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.165, geolocated to Canada. The domain is currently flagged by 5 out of 95 security vendors on VirusTotal and appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing sites leveraging legitimate CDN infrastructure. Google Safe Browsing status is not explicitly listed, but the domain remains active and unblocked by most major security providers. As of the latest assessment, liveledge-live.pages.dev remains operational, posing an ongoing risk to users. While one security vendor has blocked the domain, the low detection rate (5/95) suggests limited visibility across the security ecosystem. Users are advised to verify domain authenticity before entering credentials, and organizations should monitor for connections to 172.66.47.165 or related Cloudflare-hosted subdomains. Immediate takedown requests should be directed to the registrar, though Cloudflare’s abuse response may delay mitigation.