en-ledgr-uslive[.]pages[.]dev

This domain, en-ledgr-uslive.pages.dev, poses a direct threat as a brand impersonation site designed to distribute malicious crypto wallet management software. Analysis indicates the site mimics Ledger Live, the official application for Ledger hardware wallets, with the explicit intent to deploy crypto drainers. These malicious tools are engineered to exfiltrate cryptocurrency assets from victims' wallets by intercepting transaction signing processes or stealing private keys under the guise of legitimate software updates or installations. The page title, 'Ledger Live Download - Secure Hardware Wallet Management,' reinforces the deception by closely mirroring official Ledger branding and terminology, increasing the likelihood of successful social engineering attacks against users seeking authentic wallet management solutions. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on September 22, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.126. It is flagged by 12 out of 95 security vendors on VirusTotal, including detection as a crypto drainer or brand impersonation threat. The domain appears on one security blocklist, specifically PhishDestroy, and has been assigned a trust score of 0/100 by Gridinsoft. Technical indicators include the use of HSTS, Cloudflare infrastructure, and HTTP/3, which are commonly employed to obfuscate malicious activity and evade detection. The SSL certificate issued by Google Trust Services further lends an appearance of legitimacy, complicating manual verification efforts by end users. Users who visited en-ledgr-uslive.pages.dev or downloaded any files from the site should assume their systems and cryptocurrency assets are compromised. Immediate actions include disconnecting the device from the internet to prevent further data exfiltration, revoking any wallet permissions granted to applications installed from the domain, and transferring remaining assets to a new, secure wallet using a clean device. A full system scan should be conducted using updated security tools to detect and remove any malicious payloads. Wallet recovery phrases or private keys exposed to this domain must be considered compromised and should never be reused. Users are advised to monitor their transaction histories for unauthorized activity and report the incident to relevant cryptocurrency platforms and security response teams for further mitigation.