get-ldger-live-en[.]pages[.]dev

This domain presents an elevated risk due to its specific threat of brand impersonation targeting Ledger users. The site mimics the legitimate Ledger Live interface to trick visitors into entering their cryptocurrency wallet credentials or seed phrases, effectively acting as a crypto drainer. Although currently offline, the domain’s history and infrastructure indicate a sophisticated phishing operation designed to steal digital assets.

Technical indicators paint a clear picture of malicious intent. The domain was created on April 17, 2026, and resolves to IP address 188.114.97.3, which is associated with Cloudflare, Inc., the registrar. It carries an SSL certificate from Google Trust Services (WE1), lending a false sense of security. VirusTotal reports that only 2 out of 95 security vendors flagged the domain, meaning many engines missed it, yet it appears on one security blocklist. The page title, “Ledger® Live Desktop® | Secure Crypto® Management,” is a direct copy of the official branding. These details collectively confirm that the domain is a well-crafted impersonation designed to evade detection.

Users who may have interacted with this domain should take immediate action. Since the threat is a crypto drainer, any credentials or seed phrases entered on the site are compromised. Affected individuals should transfer all assets from the exposed wallet to a new, secure wallet generated on a trusted device. Additionally, enable two-factor authentication and monitor accounts for unauthorized transactions. Always verify Ledger-related URLs via official channels and use bookmark links rather than search results or unsolicited messages. PhishDestroy recommends reporting any similar domains to help protect the community.