log-on--legreeleve[.]pages[.]dev

This domain was identified as a brand impersonation threat targeting Ledger, a well-known cryptocurrency hardware wallet provider. The site presented itself as the official Ledger Live Desktop application, designed to trick users into entering sensitive credentials or downloading malicious software. Such impersonation attempts are commonly used to deploy crypto drainers, steal private keys, or gain unauthorized access to digital asset wallets, leading to potential financial loss for victims. Analysis indicates the domain was flagged by 7 out of 95 security vendors on VirusTotal, a notable detection rate that suggests moderate confidence in its malicious nature. The domain was registered on May 02, 2026, through Cloudflare, Inc., and resolved to the IP address 172.66.46.226. The use of Cloudflare infrastructure is a common tactic among threat actors to obscure hosting origins and evade takedown efforts. Additional technical indicators include the presence of HSTS, HTTP/3, and a Google Trust Services SSL certificate, which may lend a false sense of legitimacy to unsuspecting users. If you visited log-on--legreeleve.pages.dev or interacted with its content, immediate action is required. Disconnect the affected device from the internet to prevent potential data exfiltration. Run a full system scan using updated security software to detect and remove any malicious payloads. Change all passwords and recovery phrases associated with cryptocurrency wallets, particularly those linked to Ledger devices. Monitor wallet transactions for unauthorized activity and consider revoking any suspicious permissions granted to third-party applications. Users should also report the incident to relevant security teams and verify the authenticity of any software downloads directly from the official Ledger website.