ledgerlive-eng[.]pages[.]dev

This domain, ledgerlive-eng.pages.dev, is actively impersonating Google’s cryptocurrency wallet management platform to deceive users into disclosing sensitive credentials or installing malicious software. Analysis indicates the page mimics Ledger Live, a legitimate crypto wallet interface, with the title "Ledger Live — Secure Crypto Wallet Management," suggesting an intent to exploit trust in Google’s brand for financial fraud or credential harvesting. The infrastructure is designed to appear authentic, potentially tricking users into entering wallet recovery phrases, private keys, or personal information under false pretenses. Evidence confirms the domain was registered on September 9, 2025, through Cloudflare, Inc., and currently resolves to the IP address 104.21.80.1, hosted on Cloudflare’s network (AS13335). VirusTotal reports that 1 out of 95 security vendors has flagged this domain as malicious, while one additional security blocklist has also listed it. The SSL certificate is issued by Google Trust Services (WE1), which may further mislead users into believing the site is legitimate. Infrastructure analysis reveals the domain remains active and unmitigated, posing an ongoing risk to unsuspecting visitors. Users who have visited ledgerlive-eng.pages.dev or interacted with its content should immediately revoke any credentials or recovery phrases entered on the site. Cryptocurrency wallets linked to the domain should be considered compromised, and users are advised to transfer assets to a new wallet using a clean device. Additionally, affected individuals should monitor financial accounts for unauthorized transactions and report the incident to relevant security teams or abuse contacts. Enterprises should update blocklists to include this domain and its associated IP address to prevent further exposure.