wallet-ledger-liwe[.]pages[.]dev

This domain is flagged as a high-risk crypto wallet drainer targeting users of Ledger hardware wallets through brand impersonation. The site mimics the official Ledger Live interface, presenting itself as a secure wallet management platform to deceive victims into entering recovery phrases or private keys, enabling unauthorized fund transfers to attacker-controlled wallets. Analysis indicates the domain wallet-ledger-liwe.pages.dev was registered on October 24, 2025, through Cloudflare, Inc. It resolves to the IP address 188.114.97.3, geolocated to Cloudflare infrastructure in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of malicious domains leveraging free CDN services. VirusTotal detection shows 11 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, specifically PhishDestroy, and remains active as of the latest verification. Mitigation requires immediate blocking of the domain and associated IP address across all network security controls. Organizations should update endpoint protection rules to detect and prevent access to this domain. Users should be alerted to verify the authenticity of any Ledger-related sites by cross-referencing official documentation and avoiding interaction with unsolicited wallet management pages. Recovery phrases and private keys must never be entered on third-party platforms, regardless of apparent legitimacy. Monitoring for similar domains using variations of 'ledger' and 'wallet' in subdomains or paths is recommended to preempt further attacks.