ledger-live--publicc[.]pages[.]dev

This domain, ledger-live--publicc.pages.dev, is flagged for brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The site mimics the legitimate Ledger Live interface, presenting itself as "Ledger Live | Secure Cryptocurrency Management" to deceive users into entering sensitive credentials or wallet recovery phrases. Such tactics are commonly associated with crypto drainers, where attackers gain unauthorized access to cryptocurrency wallets and transfer funds to attacker-controlled addresses. The threat is particularly severe given the irreversible nature of blockchain transactions and the high-value targets associated with cryptocurrency management platforms. Analysis indicates the domain was registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.69. The creation date is listed as April 01, 2026, which may suggest an attempt to evade detection by appearing as a future-dated registration, though this could also be a data anomaly. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. Despite its deceptive appearance, the domain has not yet been flagged by antivirus engines, with a VirusTotal detection score of 0/95. Technical indicators include the use of HSTS, Cloudflare infrastructure, and HTTP/3, alongside an SSL certificate issued by Google Trust Services. The Gridinsoft trust score for this domain is 0/100, further corroborating its malicious nature. Users who visited ledger-live--publicc.pages.dev should assume their credentials or recovery phrases may have been compromised. Immediate action is required: revoke any active sessions or authorizations linked to the legitimate Ledger Live platform, transfer funds to a new wallet with a fresh recovery phrase, and monitor all connected accounts for unauthorized transactions. If any sensitive information was entered, enable multi-factor authentication on all associated services and consider contacting the legitimate platform’s support team for further guidance. Infrastructure analysis reveals the domain is currently offline, but similar threats may re-emerge under different domains or IPs. Continuous monitoring of wallet addresses and transaction history is recommended to detect any signs of unauthorized access.