livee-leedger[.]pages[.]dev

This domain is assessed as an elevated-risk brand impersonation infrastructure targeting Ledger users. Analysis indicates it was designed to mimic official onboarding or developer portal flows, presenting a fraudulent interface titled 'Ledger® Live – Getting Started™ Developer Portal' to mislead users into disclosing sensitive wallet credentials or recovery information. The asset is currently taken offline, but historical indicators confirm phishing intent aligned with cryptocurrency asset theft campaigns.

Technical evidence shows VirusTotal detection ratio of 9/95 security vendors, domain registration handled through Cloudflare, Inc., and initial creation date of November 07, 2025. The domain resolves to IP 188.114.96.3 and uses SSL issued by Google Trust Services. Gridinsoft trust score is 0/100, indicating severe lack of credibility. The infrastructure employs HSTS, HTTP/3, Google Analytics, and Cloudflare services, suggesting an attempt to mimic legitimate modern web security configurations. The domain appears on 1 security blocklist and has been blocked by PhishDestroy.

Users who interacted with this domain should assume potential compromise of wallet seed phrases, authentication tokens, or sensitive browser-stored credentials. Immediate actions include transferring assets to a newly generated wallet, revoking any exposed session keys, and securing recovery phrases offline. Browser data including cached credentials should be cleared, and device scans performed to detect potential keyloggers or exfiltration tools. Continued monitoring of blockchain transactions linked to affected wallets is recommended due to the high likelihood of delayed asset draining in impersonation-based attacks.