leigerd-live-lear-n[.]pages[.]dev

PhishDestroy has flagged the domain leigerd-live-lear-n.pages.dev as an active brand impersonation threat targeting Ledger users. This fraudulent site mimics Ledger’s official branding to deceive visitors into entering sensitive cryptocurrency wallet credentials or downloading malware disguised as wallet software. The page leverages Cloudflare Pages hosting and a Google Trust Services SSL certificate to appear legitimate, exploiting trust in established brands to bypass user skepticism. This domain was flagged by PhishDestroy’s automated pipeline using seed a408fa and remains under investigation. VirusTotal currently shows 0 detections out of 95 scanners, indicating that traditional signature-based defenses are not yet blocking access. The domain resolves to IP address 188.114.96.3 and was registered through Cloudflare, Inc., which is commonly abused for short-lived phishing campaigns due to Cloudflare’s legitimate hosting services being repurposed by attackers. If you visited leigerd-live-lear-n.pages.dev, do not enter any cryptocurrency wallet recovery phrases, passwords, or private keys. Disconnect from the internet if possible, then run a full antivirus scan on your device. Change Ledger account passwords only from the official ledger.com domain. Report the domain to Ledger’s abuse team and your local cybercrime unit. Monitor your crypto wallets for unauthorized transactions and consider transferring funds to a new wallet if you entered sensitive data. Always verify domains by typing URLs manually or using bookmarks—never click links in emails or messages claiming to be from Ledger.