# action-wallet-ledgjor-live.pages.dev — MALICIOUS

> action-wallet-ledgjor-live.pages.dev hosts a crypto drainer impersonating Ledger Live Wallet. 6/95 security vendors flag this domain.

## Summary
PhishDestroy identifies action-wallet-ledgjor-live.pages.dev as an active brand-impersonation campaign targeting Ledger users. The page purports to be 'Ledger Live Wallet | Your Trusted Crypto Wallet®' and is equipped with a crypto drainer kit designed to siphon cryptocurrency assets from victim wallets. The domain leverages a spoofed interface to deceive users into connecting their wallets and authorizing malicious transactions.  

This domain was flagged with a VirusTotal score of 6/95 security vendors, indicating partial detection but incomplete blocking. It is registered through Cloudflare, Inc., resolving to IP 188.114.96.3 and operating under a Google Trust Services SSL certificate. The page remains live and has not been added to Google Safe Browsing (GSB) as of this analysis. It currently shows no presence on public blocklists, leaving it accessible to potential victims.  

As of this report, the domain remains active and poses a high risk to cryptocurrency users. PhishDestroy recommends immediate network-level blocking of 188.114.96.3 and domain-level blocking of action-wallet-ledgjor-live.pages.dev. Users are advised to verify any Ledger-related links via official channels and to scan connected devices for wallet drainers. Remaining risk is high due to low blocklist coverage and continued availability.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP ?)
- Target brand: Ledger
- Page title: Ledger Live Wallet | Your Trusted Crypto Wallet®

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 6 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/59bb9600-a317-4bb8-897a-60d60995915c
- PhishDestroy: https://phishdestroy.io/domain/action-wallet-ledgjor-live.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/action-wallet-ledgjor-live.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/action-wallet-ledgjor-live.pages.dev/
Last updated: 2026-04-12