ledgerlivean[.]pages[.]dev

PhishDestroy identifies ledgerlivean.pages.dev as an active brand impersonation domain targeting Ledger users. The site is not yet flagged by antivirus engines, but all available indicators confirm malicious intent aimed at stealing cryptocurrency credentials and personal data. This domain resolves to IP 188.114.96.3 via Cloudflare and uses a Google Trust Services SSL certificate to appear legitimate. Despite zero detections on VirusTotal (1/95), the impersonation of Ledger’s official brand is a clear red flag and warrants immediate investigation.

This domain was flagged by PhishDestroy’s automated systems due to its use of a deceptive subdomain (ledgerlivean) mimicking Ledger’s official branding. Technical indicators include registration through Cloudflare, Inc., resolution to IP 188.114.96.3, and the presence of a Google Trust Services SSL certificate. The domain has not been observed on any major blocklists at this time, but the lack of detections does not equate to safety. The SSL certificate adds a false sense of security, as threat actors often leverage trusted issuers to evade detection. The domain’s structure and naming convention are designed to deceive users searching for Ledger’s official platform.

To mitigate risk, users should avoid interacting with this domain entirely. Ledger’s official domains are ledger.com and ledgerlive.com; any other domain, especially those using subdomains like .pages.dev, should be treated as untrusted. If you have visited this domain, disconnect from the internet, run a full antivirus scan, and change all passwords associated with Ledger and cryptocurrency accounts. Report this domain to Ledger’s support team and your local cybercrime unit. Block the domain at your network level and monitor for unauthorized transactions. Always verify URLs and use bookmarks to access official Ledger services.