ledger-live-we[.]pages[.]dev

The domain ledger-live-we.pages.dev is a confirmed crypto drainer that actively impersonates the trusted hardware wallet brand Ledger. This threat is currently active and hosted via Cloudflare, Inc., using a certificate issued by Google Trust Services (WE1). The domain was created on September 26, 2025, and resolves to IP address 188.114.97.3. Its page title, "Ledger Live | Secure Crypto Management," is designed to deceive users seeking to manage their cryptocurrency assets. PhishDestroy identifies this as a high-risk brand impersonation campaign targeting Ledger customers.

Technical analysis reveals that the domain is flagged by 2 out of 95 VirusTotal security vendors and appears on one security blocklist. The use of Cloudflare as a registrar and hosting provider indicates an attempt to evade detection and maintain operational stability. The SSL certificate from Google Trust Services adds a false sense of legitimacy, a common tactic used by crypto drainers to trick victims. The domain’s recent creation date and low blocklist presence suggest it is a fresh threat that may not yet be widely recognized by security tools.

As of the latest analysis, ledger-live-we.pages.dev remains active and poses a significant risk to users who may attempt to connect their Ledger devices or enter recovery phrases. PhishDestroy strongly advises users to always verify the official Ledger Live URL (ledger.com/live) and avoid interacting with unsolicited links or websites. If you have already connected your wallet or entered sensitive information, immediately transfer assets to a new, secure wallet and contact Ledger support. Report this domain to security teams and block it at the network level to prevent further compromise.