# set-up-ledger-li-walit.pages.dev — SUSPICIOUS

> PhishDestroy flags set-up-ledger-li-walit.pages.dev as a crypto drainer impersonating Ledger. 1 of 95 VirusTotal engines detected the threat on 172.66.45.42.

## Summary
PhishDestroy identifies set-up-ledger-li-walit.pages.dev as a high-risk crypto-draining domain that impersonates Ledger, the well-known hardware-wallet brand. The page is titled “Ledger Live® | Starting Up Your Device - Wallet®” and attempts to trick visitors into connecting their wallets so that any cryptocurrency balance can be drained without further confirmation. Cloudflare hosts the site on IP 172.66.45.42 and Google Trust Services issued the SSL certificate, giving it a false appearance of legitimacy.  This domain was flagged by PhishDestroy after VirusTotal reported that 1 out of 95 security scanners detected malicious activity on the page. The domain uses a sub-domain of pages.dev that was created recently and is still active, indicating a fast-turnaround campaign aimed at Ledger users who search for device-setup guides. Registrar data shows Cloudflare, Inc. as the listed provider, which is common for short-lived phishing pages that are taken down quickly once reported.  If you visited set-up-ledger-li-walit.pages.dev, disconnect your wallet immediately and revoke any permissions you granted. Do not enter any recovery phrases or seed words. Verify the correct Ledger support site by typing the URL yourself—never click links from emails or social media. Report the domain to PhishDestroy so the community can block it faster.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP ?)
- Target brand: Ledger
- Page title: Ledger Live® | Starting Up Your Device - Wallet®

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.45.42

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/28114406-d2cd-42da-a07a-81e4087156c2
- PhishDestroy: https://phishdestroy.io/domain/set-up-ledger-li-walit.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/set-up-ledger-li-walit.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/set-up-ledger-li-walit.pages.dev/
Last updated: 2026-04-12