us-live-ledger-en[.]pages[.]dev

us-live-ledger-en.pages.dev is currently under active investigation as a crypto-draining domain impersonating Ledger wallets. Security teams have observed the domain operating with live malicious intent, specifically targeting cryptocurrency users. us-live-ledger-en.pages.dev was flagged by 1 of 95 VirusTotal vendors, despite hosting content designed to siphon digital assets through fake wallet authentication pages. The domain operates under Cloudflare, Inc., resolving to IP address 188.114.97.3. It utilizes a Google Trust Services SSL certificate, which may mask its malicious nature by appearing legitimate. Current telemetry indicates no blocklist presence, though its operational status remains under scrutiny. While the immediate risk profile appears low due to zero detections, the absence of flagging does not confirm safety. Given its active deployment and clear abuse of the Ledger brand, users should treat this domain as hostile. SOC teams are advised to block the domain at the DNS and network levels, while users should avoid any interaction with the site and report any suspicious wallet prompts. Further intelligence will be disseminated as the investigation progresses.