ledgerr---live[.]pages[.]dev

This domain, ledgerr---live.pages.dev, poses a direct threat as a crypto drainer targeting Ethereum users through brand impersonation. The site mimics the official Ledger Live interface, a secure crypto management application, to deceive victims into connecting wallets or entering recovery phrases. Once compromised, attackers can drain funds from connected wallets, leading to irreversible asset loss. The domain specifically exploits trust in the Ethereum ecosystem, leveraging familiar branding to bypass user vigilance. Analysis of the domain reveals multiple indicators of malicious activity. The domain is flagged by 18 out of 95 security vendors on VirusTotal, indicating widespread detection as a threat. It was registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.143, hosted under AS13335 (Cloudflare, Inc.) in the US. The domain was created on February 21, 2026, suggesting a short lifespan typical of phishing infrastructure. It appears on at least one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to malicious sites. Users who visited ledgerr---live.pages.dev should take immediate action to mitigate risk. Disconnect any wallets connected to the site and revoke permissions via blockchain explorers or wallet management tools. Monitor wallet activity for unauthorized transactions and transfer remaining assets to a new, secure wallet. If recovery phrases or private keys were entered, assume the wallet is compromised and cease all use. Report the domain to relevant security platforms to aid in takedown efforts and alert others in the Ethereum community. Regularly check for updates from official sources regarding this threat.