ledger-live-login-dcb[.]pages[.]dev

PhishDestroy identifies ledger-live-login-dcb.pages.dev as a live brand-impersonation site currently masquerading as Ledger’s official Live login portal. The domain is weaponized as a crypto drainer, aiming to siphon cryptocurrency assets from unwitting users who enter their seed phrases or private keys. ledger-live-login-dcb.pages.dev resolves to the IP address 188.114.97.3 and is served over HTTPS with a Google Trust Services SSL certificate. VirusTotal shows 10 out of 95 security vendors have already flagged this domain, while Cloudflare, Inc. acts as both registrar and hosting provider. The page layout and branding are deliberately crafted to mimic Ledger’s legitimate login interface, tricking users into divulging sensitive wallet information. Although the domain was registered recently, its infrastructure and SSL trust scores have not aged sufficiently to evade detection systems. Mitigation for this specific threat involves immediate domain blocking and user education. Organizations should add ledger-live-login-dcb.pages.dev and its IP (188.114.97.3) to network blocklists and browser denylists. Users must be instructed to verify any Ledger login portal by manually entering https://www.ledger.com/ledger-live or using only the Ledger Live desktop/mobile app. Incoming links from email, SMS, or untrusted websites should be treated as high-risk and avoided entirely. Wallet recovery phrases should never be entered on any site other than the official Ledger Live application.