walet-ledegrlive-us[.]pages[.]dev

Analysis of the domain walet-ledegrlive-us.pages.dev indicates active brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on March 26, 2026, and remains operational as of July 12, 2026. Infrastructure analysis reveals it is hosted behind Cloudflare, resolving to the IP address 172.66.47.14, and employs security technologies such as HSTS and HTTP/3. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains leveraging Cloudflare's infrastructure. The page title, 'Ledger Live Wallet | Secure Crypto Wallet,' directly aligns with Ledger's branding, suggesting an attempt to deceive users into believing the site is the official Ledger Live platform. Security vendor assessments show 15 of 95 engines on VirusTotal flagging the domain as malicious, and it appears on at least one security blocklist. Gridinsoft assigns a trust score of 0/100, further indicating high risk. While the exact content of the page has not been analyzed, the combination of brand impersonation, hosting on a newly registered domain, and security vendor detections strongly supports classification as a phishing threat. Defenders should prioritize blocking this domain at the network level, particularly in environments where cryptocurrency-related services are accessed. Monitoring for related domains using similar naming conventions (e.g., 'ledegrlive,' 'walet') may help identify additional threats. Given the domain's use of Cloudflare, takedown efforts may require coordination with the hosting provider. No evidence currently suggests this domain is part of a broader phishing kit or campaign, but further investigation into its traffic sources and associated infrastructure is recommended.