liveledgr-io-learn[.]pages[.]dev

PhishDestroy identifies the domain liveledgr-io-learn.pages.dev as an active brand impersonation campaign targeting Ledger users. This site masquerades as the official Ledger Live download page for cryptocurrency wallet applications, attempting to deceive visitors into downloading malicious software designed to drain crypto assets. Current analysis confirms the domain remains active and is actively serving content that mimics the legitimate Ledger ecosystem. This domain was flagged by 10 of 95 VirusTotal vendors at the time of investigation, indicating it evades detection by most antivirus engines. It is registered through Cloudflare, Inc., resolving to IP address 172.66.44.182 with a valid SSL certificate issued by Google Trust Services. While the domain was created recently and has not yet accumulated significant blocklist entries or trust score penalties, its active impersonation of a major hardware wallet provider and lack of detection represent a high-risk threat to cryptocurrency users seeking legitimate software. Although the immediate threat signature remains under-investigated, this domain demonstrates clear malicious intent through its fraudulent replication of the Ledger Live interface and branding. Users are strongly advised not to interact with this domain or any linked download prompts. PhishDestroy recommends verifying all Ledger-related downloads directly through the official website ledger.com or authenticated app stores. Block this domain at the network and DNS levels, and report any exposure to security teams. Monitor crypto wallet addresses for unusual transactions following any potential interaction with this campaign.