ledger-live-ent-wallet[.]pages[.]dev

A high-risk phishing campaign is actively targeting Ledger users through the domain ledger-live-ent-wallet.pages.dev. This brand impersonation threat specifically mimics the Ledger Live Wallet interface to trick users into revealing their cryptocurrency wallet credentials or seed phrases. The page title, "Ledger Live Wallet — Get Started with Ledger®," closely resembles the legitimate Ledger Live setup flow, making it particularly dangerous for unsuspecting victims.

According to PhishDestroy's intelligence, this domain was registered on April 4, 2026, through Cloudflare, Inc., and hosts an SSL certificate issued by Google Trust Services/WE1. The site resolves to IP address 188.114.96.3 and currently appears on one security blocklist. VirusTotal analysis shows that 13 out of 95 security vendors flag this domain as malicious, indicating a strong consensus among security tools. Despite these red flags, the domain remains active and accessible to potential victims.

To protect against this threat, Ledger users should never enter their recovery phrase or private keys on any website, especially one accessed via an unsolicited link. Always navigate directly to the official Ledger site by typing "ledger.com" into the browser's address bar. PhishDestroy recommends verifying any suspected phishing domain through its platform before interacting with it. If you have already visited this site, immediately transfer your crypto assets to a new wallet created on a secure device and enable hardware security features. Report the domain to Cloudflare and Ledger's security team to help takedown efforts.