v7-ledger-live[.]pages[.]dev

This domain, v7-ledger-live.pages.dev, is actively impersonating the official Ledger Live cryptocurrency wallet management platform to harvest user credentials, recovery phrases, and private keys. Analysis indicates the site mimics the legitimate Ledger Live interface, presenting itself as a Web3 application for both desktop and mobile users. The specific threat involves tricking victims into entering sensitive wallet information, which is then exfiltrated to attacker-controlled infrastructure, leading to immediate asset theft from connected cryptocurrency wallets. Infrastructure analysis reveals multiple high-risk indicators. The domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, associated with Cloudflare’s content delivery network. VirusTotal reports that 4 out of 95 security vendors flag this domain as malicious, while it appears on at least one security blocklist. The SSL certificate, issued by Google Trust Services under the WE1 root, was created on April 04, 2026, an anomalous future date suggesting potential manipulation of registration records. The domain’s creation date discrepancy, combined with its presence on PhishDestroy’s blocklist, further corroborates its fraudulent nature. Users who have visited v7-ledger-live.pages.dev or entered credentials on the site should immediately revoke access to any connected wallets and transfer assets to a new, secure wallet. All potentially exposed devices should undergo a full malware scan using updated security tools to detect keyloggers or other credential-stealing malware. It is critical to monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If recovery phrases or private keys were entered, assume full compromise and cease using the affected wallet addresses. Report the incident to relevant cryptocurrency platforms and security teams for further mitigation.