app-live[.]pages[.]dev

This domain, app-live.pages.dev, is identified as an active phishing resource specializing in brand impersonation targeting Apple and the Ledger Live cryptocurrency wallet platform. Analysis of the page title, 'Ledger® Live App — Secure Cryptocurrency Management,' reveals an intent to deceive users into believing they are interacting with legitimate Ledger wallet software, likely to harvest cryptocurrency wallet credentials or private keys. The domain does not appear to host a known drainer kit at this time, but the combination of Apple branding and cryptocurrency management suggests a targeted attack vector against users of both ecosystems. Infrastructure analysis reveals several critical technical indicators. The domain was registered through Cloudflare Pages on March 27, 2026, and resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns leveraging legitimate CDN infrastructure. Detection metrics indicate moderate but concerning visibility: 8 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on one security blocklist, specifically PhishDestroy. No entries were found in Google Safe Browsing at the time of analysis. The domain remains active as of this report, posing a continued risk to users who may be redirected or lured through social engineering tactics. Response actions should include immediate blocking of the domain and IP address at the network level, as well as monitoring for related subdomains or newly registered lookalike domains. The remaining risk is classified as high due to the active status, cryptocurrency targeting, and the use of reputable CDN infrastructure to evade detection. Users are advised to verify domain authenticity before entering credentials and to employ hardware-based multi-factor authentication for cryptocurrency transactions.