live-leedger-oi[.]pages[.]dev

This domain poses a high-risk brand impersonation threat by mimicking the official Ledger Developer Portal under the guise of 'Ledger Live Integrations.' The page is designed to deceive users into believing they are interacting with legitimate Ledger infrastructure, potentially leading to credential harvesting or the deployment of crypto-draining malware. The fraudulent site exploits trust in the Ledger brand to execute unauthorized transactions or exfiltrate sensitive wallet recovery phrases, targeting cryptocurrency holders who rely on Ledger hardware wallets for security. Analysis indicates the domain live-leedger-oi.pages.dev is hosted on Cloudflare infrastructure, resolving to the IP address 172.66.44.80. It was registered through Cloudflare, Inc. on April 09, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. The SSL certificate is issued by Google Trust Services (WE1), adding a superficial layer of legitimacy. Security vendor detections on VirusTotal report 5 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The page title, 'Ledger Live Integrations — Ledger Developer Portal,' directly mirrors official Ledger branding, increasing the likelihood of successful deception. Users who have visited live-leedger-oi.pages.dev should immediately cease all interaction and assume their credentials or recovery phrases may be compromised. Any entered sensitive information, including wallet passwords or seed phrases, must be considered exposed. Affected individuals should transfer assets from potentially compromised wallets to new, secure addresses using an untainted device. Additionally, they should monitor transaction histories for unauthorized activity and report the domain to relevant abuse channels for takedown. Enabling multi-factor authentication on all cryptocurrency-related accounts is strongly advised to mitigate further risk.