portal-ledgr-live-wallet[.]pages[.]dev

The domain portal-ledgr-live-wallet.pages.dev has been identified as a high-risk crypto drainer, specifically designed to impersonate the Ledger Wallet interface. This domain facilitates the unauthorized transfer of cryptocurrency assets from victims' wallets by deploying malicious JavaScript payloads upon interaction. Current analysis confirms the domain remains active and operational, posing an immediate threat to users who may mistake it for the legitimate Ledger platform. Infrastructure analysis reveals the domain was registered on May 27, 2026, through Cloudflare Pages, a service often exploited for its ease of deployment and anonymity. Security telemetry indicates that 15 of 95 vendors on VirusTotal have flagged this domain as malicious, while it appears on one additional security blocklist. The domain's unique seed identifier, 67894c, further distinguishes it in threat intelligence repositories. No legitimate association with Ledger SAS or its official services has been established, reinforcing its fraudulent nature. Current status confirms the domain remains active, with no takedown or mitigation measures observed as of this report. Organizations and individuals are advised to block this domain at the network perimeter and update endpoint protection rules to include its indicators of compromise. Users should verify wallet addresses and transaction prompts against official Ledger channels before executing any transfers. Given the domain's persistence and high-risk classification, monitoring for related infrastructure or similar impersonation attempts is recommended.