io-home-ledgr[.]pages[.]dev

This domain, io-home-ledgr.pages.dev, presents a high-severity brand impersonation threat targeting users of Ledger cryptocurrency hardware wallets. Analysis indicates the site mimics the official Ledger Live Desktop interface, presenting a page titled 'Ledger Live Desktop — Secure Crypto Management' to deceive victims into interacting with malicious software. The infrastructure is designed to deploy crypto drainer malware, which automatically siphons digital assets from connected wallets upon execution, posing a direct financial risk to users who engage with the fraudulent interface.

Evidence supporting this assessment includes multiple technical indicators. The domain was registered on November 07, 2025, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, geolocated to Canada under Cloudflare’s network. Security vendor analysis on VirusTotal reveals that 11 out of 95 engines flag the domain as malicious. Additionally, the domain appears on three independent security blocklists, and its infrastructure has been proactively blocked by multiple wallet protection mechanisms. The page title and visual design closely replicate Ledger’s legitimate software, increasing the likelihood of successful social engineering attacks.

Users who have visited io-home-ledgr.pages.dev or interacted with its content should immediately disconnect any connected wallets and cease all engagement. Affected devices should undergo a full malware scan using updated security tools to detect and remove potential crypto drainer payloads. Wallet recovery phrases or private keys entered on the site must be considered compromised; users are advised to transfer remaining assets to a new, secure wallet using a clean device. Monitoring for unauthorized transactions is critical, and any suspicious activity should be reported to relevant blockchain analytics platforms for further investigation.