ledger--lived[.]pages[.]dev

PhishDestroy identifies ledger--lived.pages.dev as an active brand impersonation domain targeting Ledger cryptocurrency wallet users to harvest account credentials and install malware. This domain, hosted through Cloudflare Pages, presents a high-risk threat vector by mimicking Ledger’s official branding to deceive visitors into entering sensitive recovery phrases or private keys. Despite current antivirus evasion with 6/95 detections on VirusTotal, this threat remains unclassified by major blocklists and continues to operate with active resolution to IP 172.66.47.155 under a Google Trust Services SSL certificate.

This domain was flagged due to clear brand impersonation of Ledger's hardware wallet ecosystem, leveraging Cloudflare’s Pages.dev platform to mimic legitimate Ledger Live or support domains. Registrant details remain masked as expected with Cloudflare’s privacy protections, providing no additional context for attribution. Risk assessment indicates this is not a false positive—typical false positives exceed 10% on VT—but rather a zero-detection adversary campaign with no prior classification. The SSL certificate issued by Google Trust Services adds superficial legitimacy, further reducing user suspicion despite the malicious intent.

Users and organizations encountering ledger--lived.pages.dev should immediately block the domain and IP 172.66.47.155 at network and endpoint levels. For Ledger users, verify any domain claiming to offer support or updates directly through the official ledger.com domain. Report this impersonation to Ledger Support and consider enabling hardware wallet verification prompts on device screens before entering recovery phrases. Enterprises should update DNS filtering rules and conduct phishing awareness training focused on brand spoofing in crypto wallet ecosystems.