# recovery-ledgerlivecheck.com — SUSPICIOUS

> PhishDestroy finds recovery-ledgerlivecheck.com hosting a Ledger seed-phrase phishing page. Check the full report.

## Summary
PhishDestroy identifies the active domain recovery-ledgerlivecheck.com that impersonates Ledger’s official recovery portal to steal cryptocurrency wallet seed phrases.

This domain was flagged by exactly 2 of 95 VirusTotal security vendors five days after it was registered on 29 March 2024 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP 104.21.84.184 and carries a Let’s Encrypt SSL certificate.

If you visited recovery-ledgerlivecheck.com, stop entering any information. Clear your browser cache, run a malware scan, and disconnect any wallets you may have interacted with. Monitor balances for unusual withdrawals and report any loss to both Ledger and local law enforcement.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Ledger

## Domain Intelligence
- Registered: 2026-03-29 23:32:34
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 104.21.84.184

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/caf5dc39-61df-4cd2-a4f2-021545121a1e
- PhishDestroy: https://phishdestroy.io/domain/recovery-ledgerlivecheck.com/
- LLM endpoint: https://phishdestroy.io/domain/recovery-ledgerlivecheck.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/recovery-ledgerlivecheck.com/
Last updated: 2026-03-31