doc-livelgr--us[.]pages[.]dev

This domain impersonates Ledger, a cryptocurrency hardware wallet provider, to distribute malicious software under the guise of the official Ledger Live application. Visitors are presented with a fraudulent download page titled 'Ledger Live Download | Crypto Wallet App | Ledger,' designed to trick users into installing malware or disclosing sensitive credentials. The site specifically targets cryptocurrency holders, posing a risk of unauthorized access to wallets, theft of private keys, or installation of crypto-draining malware that automatically transfers funds to attacker-controlled addresses.

Analysis indicates the domain was registered on April 30, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. It is flagged by 8 out of 95 security vendors on VirusTotal, with additional detections on one security blocklist. The domain employs HTTPS via a Google Trust Services SSL certificate and utilizes Cloudflare’s infrastructure, including HTTP/3 and HSTS, to appear legitimate. Despite these technical measures, the creation date discrepancy and brand impersonation confirm its malicious intent.

If you visited doc-livelgr--us.pages.dev or downloaded files from it, immediately disconnect the affected device from the internet and any cryptocurrency wallets. Do not enter any credentials or private keys. Scan the device with updated security software to detect and remove malware. Verify the authenticity of any Ledger-related downloads by accessing the official Ledger website directly via a trusted browser. Monitor cryptocurrency wallets for unauthorized transactions and consider transferring funds to a new wallet if compromise is suspected. Report the incident to your security team or a trusted cybersecurity provider for further analysis.