ldgr-liive-wallet[.]pages[.]dev

PhishDestroy has identified ldgr-liive-wallet.pages.dev as a confirmed brand impersonation threat targeting Ledger cryptocurrency wallet users. This domain was specifically crafted to mimic the legitimate Ledger Live interface, attempting to steal users' recovery phrases and private keys. The threat type is brand impersonation, leveraging the trusted Ledger name to deceive victims into surrendering their crypto assets.

Technical analysis reveals that the domain was created on April 3, 2026, and is registered through Cloudflare, Inc. It resolves to IP address 172.66.44.140 and uses an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports that 9 out of 95 security vendors flag this domain as malicious, and it appears on at least one security blocklist. The page title, "Suspected phishing site | Cloudflare," indicates that Cloudflare's own systems have already taken protective action.

As of the latest check, the domain is offline and has been taken down. However, the remaining risk is that similar domains may appear under different names. Users should always verify that they are on the official Ledger website (ledger.com) and never enter recovery phrases into any online interface. PhishDestroy recommends using hardware wallets and enabling two-factor authentication to mitigate such threats.