# le-welcomee-ledger-live.pages.dev — MALICIOUS

> le-welcomee-ledger-live.pages.dev impersonates Ledger to steal crypto wallet credentials. 8/95 security vendors flag this domain; avoid entering sensitive data.

## Summary
PhishDestroy identifies le-welcomee-ledger-live.pages.dev as an active brand impersonation phishing domain targeting Ledger users.

This domain was flagged by 8 out of 95 VirusTotal security vendors, resolves to IP 188.114.97.3, and uses a Google Trust Services SSL certificate. Registered through Cloudflare, Inc., the page is hosted on pages.dev, a legitimate Cloudflare Pages domain that is being abused to lend false credibility to the scam.

Immediate mitigation is required: block the domain at network/firewall levels and instruct users to verify any Ledger-themed links by navigating directly to the official Ledger Live site (ledger.com). Never enter recovery phrases or credentials on pages linked from unexpected emails or messages.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Ledger

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 8 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/a2faf14c-fc65-4ef5-ac59-de788ae342d7
- PhishDestroy: https://phishdestroy.io/domain/le-welcomee-ledger-live.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/le-welcomee-ledger-live.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/le-welcomee-ledger-live.pages.dev/
Last updated: 2026-03-23