learn-live-wlt-s[.]pages[.]dev

PhishDestroy has identified learn-live-wlt-s.pages.dev as a high-risk brand impersonation domain actively targeting Ledger cryptocurrency wallet users. This sophisticated phishing site poses as the legitimate Ledger Live Wallet developer portal, attempting to harvest sensitive login credentials and recovery phrases from unsuspecting victims. The threat is elevated due to its active status and use of Cloudflare Pages hosting, which can evade basic security filters.

Technical analysis reveals several concerning indicators: the domain was created on April 24, 2026, and resolves to IP address 172.66.47.176. VirusTotal data shows 2 out of 95 security vendors flagging this domain as malicious, while it also appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), lending a false sense of legitimacy. The page title explicitly reads "Ledger® Live Wallet – Getting Started™ | Developer Portal," a clear imitation of the official brand. The domain was registered through Cloudflare Pages, a common choice for phishing operations due to its free tier and ease of deployment.

Users who encounter this domain should immediately close the page and avoid entering any information. Ledger customers should only access their wallets through the official website at ledger.com or the official Ledger Live application. Those who may have already entered credentials should transfer funds to a new wallet immediately and enable two-factor authentication on all associated accounts. PhishDestroy recommends reporting this domain to Cloudflare and relevant cybersecurity authorities to expedite takedown, while also running a full antivirus scan on any device that may have accessed the site.