support-legdrr[.]pages[.]dev

This domain, support-legdrr.pages.dev, operates as a credential harvesting platform specifically designed to impersonate Ledger, a hardware cryptocurrency wallet provider. The site mimics the legitimate Ledger Live onboarding process, presenting users with a fraudulent interface titled 'Getting Started with Ledger Live' to deceive victims into entering sensitive wallet recovery phrases, private keys, or login credentials. Analysis indicates the domain is engineered to exploit trust in the Ledger brand, likely targeting cryptocurrency holders who may be less technically vigilant during wallet setup or recovery procedures. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on March 22, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.57, located in Canada. Security vendor detections on VirusTotal show 12 out of 95 engines flagging the domain as malicious, while it appears on at least one security blocklist and is actively blocked by enterprise phishing protection systems. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections to the fraudulent site, further enhancing its appearance of legitimacy. Users who visited support-legdrr.pages.dev should assume their credentials or recovery phrases have been compromised. Immediate action is required: revoke any entered credentials, transfer cryptocurrency assets to new wallet addresses, and monitor all linked accounts for unauthorized transactions. If hardware wallet recovery phrases were exposed, the device should be considered insecure and replaced. System scans for malware are recommended, as phishing sites may deploy additional payloads. Users should verify domain authenticity by cross-referencing official Ledger communications channels before engaging with any wallet-related services.