# ledger-llivee.pages.dev — SUSPICIOUS

> ledger-llivee.pages.dev is a crypto drainer impersonating Ledger Live with 0/95 VirusTotal detections. Verify with PhishDestroy before entering any data.

## Summary
PhishDestroy identifies the domain ledger-llivee.pages.dev as an active brand impersonation campaign targeting Ledger cryptocurrency users. This site masquerades as Ledger Live to steal private keys or seed phrases, a tactic consistent with cryptocurrency drainer operations. The threat is especially dangerous because it uses a Cloudflare Pages subdomain (pages.dev) and a Google Trust Services SSL certificate to appear legitimate, evading instant detection.  This domain was flagged during routine monitoring and shows high-risk indicators: VirusTotal currently reports 0 detections out of 95 scanners, meaning antivirus engines have not yet blacklisted it. The domain resolves to IP address 172.66.46.253 and is registered under Cloudflare, Inc., a common tactic used to obscure ownership and host malicious content on reputable infrastructure. While the exact creation date is not publicly available, the use of a .pages.dev subdomain suggests recent deployment, likely within days or weeks. The combination of zero detections, trusted certificate, and Ledger branding makes this a stealthy and evolving threat.  Users who have visited ledger-llivee.pages.dev should immediately disconnect any connected cryptocurrency wallets, disable browser extensions that may interact with web3 sites, and scan their device with updated antivirus software. Do not enter any private keys, seed phrases, or wallet passwords on this or similar sites. Verify any Ledger-related URL through official Ledger channels (e.g., ledger.com) and use tooling like PhishDestroy to confirm legitimacy. If you suspect exposure, consider transferring assets to a new wallet with a different seed phrase and revoke any connected app permissions via blockchain explorers.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Ledger

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.46.253

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/ledger-llivee.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/ledger-llivee.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/ledger-llivee.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/ledger-llivee.pages.dev/
Last updated: 2026-04-03