ledger--liveapp-web[.]pages[.]dev

PhishDestroy identifies an active brand impersonation threat involving the domain ledger--liveapp-web.pages.dev. This fraudulent site specifically mimics Ledger’s official web application, creating a high-risk deception for cryptocurrency users seeking secure wallet access. The campaign is currently under investigation but remains active, with threat actors leveraging cloud-hosted infrastructure to evade detection. Given the targeting of a major hardware wallet brand and the use of a Pages.dev subdomain mimicking a legitimate platform, this represents a credible phishing threat with potential for credential theft and financial compromise. This domain was flagged for impersonating Ledger, resolving to IP address 172.66.45.34 via Cloudflare, Inc. VirusTotal analysis shows 0 detections out of 95 engines, indicating low detection despite clear malicious intent. It holds a valid SSL certificate issued by Google Trust Services, which may increase user trust and reduce immediate browser warnings. The combination of high-profile brand abuse, zero initial detection, and trusted certificate issuance suggests advanced evasion tactics designed to bypass security controls and deceive users. To mitigate exposure, users should avoid accessing Ledger-related services via third-party links, especially those hosted on Pages.dev or similar cloud platforms. Always navigate to ledger.com directly and verify the URL and SSL certificate in the browser address bar. Organizations should block the domain ledger--liveapp-web.pages.dev at the network perimeter and update browser security policies to flag Pages.dev subdomains impersonating financial brands. Report any encounters to Ledger’s official support channels and share threat intelligence via PhishDestroy’s reporting system. Proactive monitoring of new cloud-hosted domains mimicking Ledger is strongly recommended.