ledgor-live-en[.]pages[.]dev

PhishDestroy identifies an active impersonation campaign targeting Ledger Live users via the domain ledgor-live-en.pages.dev. This site masquerades as an official Ledger Live guide while covertly hosting crypto-draining scripts designed to divert private keys and tokens during wallet connections. The domain resolves to Cloudflare IP 172.66.47.98 and is delivered over a Google Trust Services SSL certificate, lending false legitimacy. Browser pop-ups and fake login prompts capture seed phrases and private keys, enabling silent fund extraction once permissions are granted. This domain was flagged on seed 3d2208 with zero VirusTotal detections (2/95 engines) and uses Cloudflare Pages for rapid deployment. Registration through Cloudflare, Inc. provides anonymity and evasion, while the SSL certificate from Google Trust Services obscures the true origin from casual users. The page title “Ledger Live | Complete Guide to Secure Ledger Live Usage” closely mimics the legitimate service to trick security-conscious users searching for setup guidance. Current evidence shows no third-party blocklist inclusion, indicating a fresh campaign still evading automated defenses. Users who visited ledgor-live-en.pages.dev must immediately scan connected wallets using PhishDestroy’s wallet drainer detection tool. Do not enter any seed phrases, private keys, or wallet passwords on this domain. Disconnect all devices from the internet to prevent unauthorized RPC calls. If any funds were involved, file a report with Ledger’s official support channel and your local cybercrime unit, including transaction hashes and wallet addresses. Monitor all linked wallets for unauthorized transfers and revoke any suspicious smart contract approvals through blockchain explorers.