ldgerr-live-download[.]pages[.]dev

This domain, ldgerr-live-download.pages.dev, operates as a fraudulent crypto wallet interface designed to impersonate the legitimate Ledger Live platform. Analysis indicates the site functions as a cryptocurrency drainer, tricking victims into connecting their wallets to malicious smart contracts that automatically siphon funds. The threat specifically targets users of hardware wallets by mimicking the authentication flow and recovery phrase submission process, enabling attackers to gain full control of victims' assets once credentials are entered. Infrastructure analysis reveals the site was engineered to bypass initial detection, as evidenced by its technical implementation and social engineering tactics. Evidence supporting this assessment includes multiple concrete indicators. The domain currently shows 0 detections across 95 security engines on VirusTotal, suggesting either recent deployment or evasion techniques. It is registered through Cloudflare, Inc., with a creation date of April 05, 2026, which appears anomalous given the current timeline. The domain resolves to IP address 172.66.44.104 and holds a Gridinsoft trust score of 0 out of 100. While only appearing on one security blocklist at present, the SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to potential victims. Users who visited ldgerr-live-download.pages.dev should immediately disconnect any connected wallets from the site and revoke all associated smart contract approvals. All credentials entered on the site must be considered compromised, necessitating the creation of new wallet addresses and migration of assets. Hardware wallet users should perform a factory reset and restore using a secure backup phrase not exposed to this domain. Monitoring for unauthorized transactions is critical, and affected parties should report the incident to relevant blockchain security teams for further analysis and potential fund recovery efforts.