ledgerlivedownload-us[.]pages[.]dev

PhishDestroy identifies ledgerlivedownload-us.pages.dev as an active phishing domain impersonating Ledger’s official Live application to steal cryptocurrency wallet credentials. The site is currently live and leverages Cloudflare Pages to host a fraudulent download page designed to mimic the legitimate software interface. This campaign presents a high risk to users seeking secure crypto management tools.

This domain was flagged by 7 of 95 VirusTotal vendors as of the latest scan, indicating it has not yet been widely detected by security engines. It resolves to IP address 188.114.97.3, registered through Cloudflare, Inc., which provides anonymity and resilience against takedown efforts. While the SSL certificate is issued by Google Trust Services—often leveraged to evade suspicion—the domain’s recent creation and absence from major blocklists suggest an emerging threat. Trust scores remain low due to the lack of detection and suspicious branding alignment with a well-known financial software provider.

Current status shows an under-investigation classification, but immediate action is required. Users attempting to download Ledger Live should only use the official domain ledger.com or verified app stores. Organizations are advised to block ledgerlivedownload-us.pages.dev at the network level and alert users via internal security channels. Cryptocurrency holders are urged to verify software sources and enable hardware wallet authentication to mitigate exposure.