ei-us-live-legr[.]pages[.]dev

PhishDestroy identifies ei-us-live-legr.pages.dev as an active brand-impersonation page masquerading as the official Ledger Live crypto app. This domain serves a counterfeit “Ledger Live — Secure Crypto App (Presentation)” page designed to trick users into connecting cryptocurrency wallets and draining assets. The page URL leverages Cloudflare Pages and Google Trust Services certificates to appear legitimate, but the underlying intent is malicious. This domain resolves to IP 188.114.96.3 and shows zero detections on VirusTotal at the time of analysis (3/95 engines). It is registered through Cloudflare, Inc. and remains active despite clear impersonation of the Ledger brand. The risk level is currently under investigation, but the presence of a crypto drainer payload elevates the threat to high-risk for visitors who interact with the page. Users who have visited ei-us-live-legr.pages.dev should immediately disconnect any connected wallets, revoke any wallet-connect permissions via Ledger Live or the wallet’s official interface, and scan device(s) for malware using reputable security software. If you entered wallet credentials or signed a transaction, report the incident to Ledger support and consider transferring remaining assets to a new, isolated wallet. Verify any Ledger-related links using official channels listed at ledger.com before proceeding.