ledgar-liue-wallat[.]pages[.]dev

This domain poses a direct brand impersonation threat targeting users of a cryptocurrency hardware wallet platform. Analysis indicates the domain mimics the official Ledger Live application interface, presenting itself as the legitimate "Ledger Live App® | Official Ledger Mobile & Desktop Application." The objective appears to be credential harvesting or distribution of malicious software under the guise of a trusted cryptocurrency management tool, potentially leading to unauthorized access to digital assets or financial loss. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 11, 2026, and currently resolves to the IP address 188.114.97.3. Detection metrics show 0 detections out of 95 engines on VirusTotal, suggesting the campaign may still be in an early or evasive phase. The domain appears on one security blocklist and is secured with an SSL certificate issued by Google Trust Services. Additional technical indicators include the use of HSTS, Cloudflare infrastructure, and HTTP/3 protocol, which may be leveraged to enhance perceived legitimacy or evade detection. Users who visited this domain should immediately revoke any credentials or recovery phrases entered on the site. All connected devices should undergo a full security scan to detect potential malware or unauthorized access. Cryptocurrency wallet users are advised to verify all transactions and enable multi-factor authentication on all related accounts. If financial or personal data was submitted, affected individuals should monitor for unauthorized activity and consider reporting the incident to relevant financial or cybersecurity authorities.