ledgapp-live[.]pages[.]dev

This domain, ledgapp-live.pages.dev, is flagged for brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site mimics the official Ledger Live application download portal, presenting a high-fidelity replica of the legitimate interface. The page title, 'Ledger Live App — Official Download Guide,' reinforces the deception, likely intended to harvest user credentials or distribute malicious software under the guise of a trusted brand. No explicit crypto drainer kit signatures were identified, but the domain exhibits characteristics consistent with credential theft or malware distribution infrastructure.

Technical indicators reveal the domain was registered on April 12, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.74. VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged by security vendors. The domain appears on a single security blocklist, and its Gridinsoft trust score is 0/100, indicating a complete lack of reputation. The site employs HSTS and HTTP/3 protocols, alongside a Google Trust Services SSL certificate, which may lend an air of legitimacy to unsuspecting users. Google Safe Browsing (GSB) status is not explicitly provided, but the domain's infrastructure and registration details align with known phishing patterns.

As of the latest assessment, ledgapp-live.pages.dev has been taken offline, likely in response to reports or automated takedown mechanisms. The domain was blocked by at least one security provider, though the absence of broader detections suggests it may have evaded early detection. Remaining risk includes potential re-emergence under a similar domain or IP, as well as the possibility of residual compromise for users who interacted with the site prior to takedown. Users are advised to verify domain authenticity via official Ledger channels, monitor for unauthorized transactions, and report any suspicious activity to their security teams. Infrastructure analysis reveals the use of Cloudflare services, which may complicate attribution but also provides an avenue for further mitigation through provider-level interventions.