connect-ledgarlive[.]pages[.]dev

PhishDestroy identifies domain connect-ledgarlive.pages.dev as an active brand impersonation threat impersonating Ledger. Current status remains active and under investigation.

This domain was flagged by 9 of 95 VirusTotal vendors and is registered through Cloudflare, Inc. The malicious page resolves to IP 188.114.96.3 and displays a spoofed page title identical to Ledger’s official site. No known blocklist entries exist at the time of analysis, while the SSL certificate is issued by Google Trust Services, indicating an attempt to appear legitimate through trusted infrastructure.

The domain remains operational and has not been globally blocked despite zero detections. Users should treat this domain as hostile and avoid interaction. Recommendations include blocking the domain at DNS and network levels, monitoring for connections to IP 188.114.96.3, and verifying Ledger access only through official channels such as ledger.com or the verified Ledger Live application. Enterprise environments should update firewall rules and user awareness training to include this specific impersonation vector. Immediate action is advised to prevent credential theft or cryptocurrency drainer activity.