ledgerlive--en--us[.]pages[.]dev

PhishDestroy identifies active brand impersonation threats targeting Ledger users via the domain ledgerlive--en--us.pages.dev. This domain is currently under investigation for attempting to deceive victims through the imitation of Ledger's official branding, a tactic commonly associated with cryptocurrency drainers or credential theft. The threat, categorized as brand impersonation, remains active and poses a significant risk to users seeking legitimate Ledger services.

This domain was flagged by 7 of 95 VirusTotal vendors, indicating it has not yet been widely recognized as malicious by security solutions. Registered through Cloudflare, Inc., the domain resolves to IP address 188.114.96.3 and is secured with a Google Trust Services SSL certificate. The domain was created recently, with no additional blocklist records or trust score metrics currently available. Despite its low detection rate, the domain's use of Cloudflare infrastructure and a valid SSL certificate suggests an attempt to appear legitimate to unsuspecting users.

Users are strongly advised to avoid accessing ledgerlive--en--us.pages.dev and to verify any Ledger-related domains through official channels. Immediate actions include blocking the domain and IP address 188.114.96.3 at the network level. Additionally, users should cross-check URLs using Ledger's official website or documentation to prevent falling victim to crypto drainers or credential theft. Security teams should monitor this domain for changes in detection status or infrastructure and report findings to relevant threat intelligence platforms.