liveledgers-diy[.]pages[.]dev

This domain, liveledgers-diy.pages.dev, is actively engaged in brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The site presents itself as the official Ledger onboarding page (ledger.com/start) and prompts users to download a malicious version of Ledger Live software. Such activity is designed to deceive users into installing crypto-draining malware or disclosing recovery phrases, leading to unauthorized access and theft of digital assets.

Analysis indicates the domain was registered on April 4, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, located in Canada. The domain appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent, as the page title and content closely mimic legitimate Ledger resources. Infrastructure analysis reveals the use of Cloudflare Pages, a common platform for rapid deployment of phishing sites.

Users who have visited liveledgers-diy.pages.dev or downloaded software from it should immediately disconnect affected devices from the internet. They must avoid entering any recovery phrases or private keys and should perform a full antivirus scan using updated security tools. Affected wallets should be considered compromised; users are advised to transfer remaining assets to a new, secure wallet using an uncompromised device. Additionally, monitor all linked accounts for unauthorized transactions and report the incident to relevant security teams or financial platforms.