live-ledge-wallet-us[.]pages[.]dev

This domain, live-ledge-wallet-us.pages.dev, is flagged as an active credential harvesting platform targeting users of the Ledger cryptocurrency wallet. Analysis indicates the site presents a fraudulent replica of the official Ledger Live application interface, designed to capture sensitive authentication details, recovery phrases, or private keys from unsuspecting victims. The domain exhibits clear indicators of brand impersonation, specifically mimicking Ledger’s visual design and page structure, including the identical page title 'Ledger Live | Ledger Live Crypto Wallet App — Presentation.' Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 29, 2026, and resolves to the IP address 172.66.47.79, geolocated in Canada under Cloudflare’s network. As of the latest assessment, the domain has not been flagged by Google Safe Browsing and holds a VirusTotal detection score of 0/95, indicating no antivirus engines currently identify it as malicious. Despite its low detection rate, the domain appears on a single security blocklist, suggesting preliminary awareness within the threat intelligence community. The domain remains active and unmitigated, posing an ongoing risk to cryptocurrency users. While no drainer kit components have been confirmed, the credential harvesting mechanism is consistent with phishing tactics observed in prior campaigns targeting hardware wallet users. Users are advised to verify domain authenticity by cross-referencing official Ledger communication channels and to avoid entering sensitive information on unverified platforms. Organizations should monitor for connections to 172.66.47.79 and consider preemptive blocking of the domain to prevent potential credential compromise.