ledgerlive003xwsk[.]pages[.]dev

This domain, ledgerlive003xwsk.pages.dev, poses a specific threat of brand impersonation, targeting users of the Ledger cryptocurrency wallet. The site is designed to mimic the official Ledger Live interface, potentially tricking users into divulging sensitive information such as login credentials, private keys, and other personal data. The risk level is elevated due to the high likelihood of financial loss and identity theft if users are deceived by this impersonation.

Analysis indicates that the domain was registered through Cloudflare, Inc. on September 11, 2025. The SSL certificate is issued by Google Trust Services / WE1, which may lend a false sense of security to unsuspecting visitors. The domain resolves to the IP address 2606:4700:310c::ac42:2d06, located in the United States (AS13335 Cloudflare, Inc.). According to VirusTotal, 11 out of 95 security vendors have flagged this domain as malicious. Additionally, the domain appears on one known security blocklist, further corroborating its malicious intent. The page title 'Suspected phishing site | Cloudflare' also suggests that the site has been identified and labeled as a potential threat by Cloudflare's security measures.

If users have visited ledgerlive003xwsk.pages.dev, they are advised to immediately change their Ledger Live account passwords and any associated recovery phrases. It is crucial to monitor financial accounts for any unauthorized transactions and to report any suspicious activity to Ledger's official customer support. Users should also run a full system scan using reputable antivirus software to ensure that no malware has been installed. To avoid similar threats in the future, users should verify the URL of the official Ledger Live website and avoid clicking on links from untrusted sources.