liveledger--wallet[.]pages[.]dev

This domain, liveledger--wallet.pages.dev, operates as a confirmed phishing infrastructure designed to impersonate Ledger, a hardware cryptocurrency wallet provider. The site specifically targets users seeking to access or manage their Ledger wallets, presenting fraudulent login interfaces to harvest credentials, recovery phrases, or private keys. Given the high-value nature of cryptocurrency assets, such phishing attempts pose severe financial risks, including unauthorized access to wallets and irreversible fund theft. The domain employs social engineering tactics, such as urgency or fake security alerts, to manipulate victims into disclosing sensitive information. Analysis indicates the domain was registered on March 25, 2026, through Cloudflare Pages, a platform often leveraged for rapid deployment of phishing sites due to its ease of use and free hosting capabilities. The domain resolves to the IP address 188.114.97.3, associated with Cloudflare, Inc., and is hosted in Canada. Security vendors have flagged the domain as malicious, with VirusTotal reporting 11 out of 95 vendors detecting it as phishing. Additionally, the domain appears on one security blocklist, and Google Safe Browsing has explicitly labeled it as a phishing threat. The SSL certificate, issued by Google Trust Services (WE1), further confirms its association with Cloudflare infrastructure, though this does not mitigate the malicious intent of the site. Users who visited liveledger--wallet.pages.dev should assume their credentials or recovery phrases may have been compromised. Immediate action is required: revoke any access granted to the site, change passwords for associated accounts, and enable multi-factor authentication where available. If cryptocurrency wallet credentials or recovery phrases were entered, users must transfer assets to a new, secure wallet and monitor all linked accounts for unauthorized transactions. Additionally, affected users should scan their devices for malware, as phishing sites may deploy additional payloads. Reporting the domain to relevant security teams or cryptocurrency platforms can aid in mitigating further risks to the broader community.