ledger-us-live-cbc[.]pages[.]dev

The domain ledger-us-live-cbc.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. It posed as the legitimate Ledger Live application to deceive users into entering sensitive credentials or wallet information, classifying it as a cryptocurrency scam. No drainer kit was detected, but the site was actively used for credential harvesting before being taken offline.

Technical analysis shows ledger-us-live-cbc.pages.dev was flagged by 3 of 95 security vendors on VirusTotal, including Kaspersky, LevelBlue, and Phishing Database. It appeared on 1 security blocklist (PhishDestroy) and was not flagged by Google Safe Browsing. The domain was registered through Cloudflare, Inc. on September 23, 2025, and resolved to the IP address 172.66.47.46, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Ledger Live App - Secure Crypto Management'. Technologies detected included HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100.

Users who interacted with ledger-us-live-cbc.pages.dev should immediately change any exposed credentials, enable two-factor authentication, and monitor accounts for unauthorized activity. For cryptocurrency wallets, revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. Report the phishing domain to Ledger’s official security team, Cloudflare’s abuse reporting system, and platforms like Google Safe Browsing or PhishTank to aid in takedown efforts.