leddger-live-login[.]pages[.]dev

PhishDestroy identifies leddger-live-login.pages.dev as an active brand impersonation domain masquerading as Ledger Live in order to harvest seed phrases and private keys. The page exfiltrates cryptographic secrets directly to attacker-controlled wallets, qualifying it as a crypto drainer fronted by a legitimate cloud service page. This domain was flagged by PhishDestroy on seed f9d694 with a VirusTotal scan result of 0 detections out of 95 engines as of the latest query, indicating zero proactive blocking. The site is hosted behind Cloudflare IP 172.66.44.229 and uses a Google Trust Services certificate to enhance authenticity. Registrar data shows registration via Cloudflare, Inc., with no public creation date disclosed. The landing page title reads “Ledger Live | Manage Your Crypto™ Assets Safely,” a direct copy of the official Ledger branding to deceive visitors. Any user who visited this domain and entered wallet credentials, seed phrases, or private keys should immediately revoke those keys in a secure offline wallet, transfer remaining assets to a newly generated address, and perform a factory reset on any device previously exposed to the page. Disable browser auto-fill for crypto sites and install the latest blocklists from PhishDestroy or your threat-intel provider. Report the incident to Ledger support and change all related account passwords with multi-factor authentication enabled.