ledger-llivee[.]pages[.]dev

The phishing domain ledger-llivee.pages.dev is designed to impersonate Ledger, a popular cryptocurrency hardware wallet brand. This domain is flagged by 1 out of 94 vendors on VirusTotal, indicating its malicious intent. It is hosted by Cloudflare in Canada, with an SSL certificate issued by Google Trust Services. The domain was created and detected by PhishDestroy on April 3, 2026.

This domain presents itself as an official guide for Ledger Live, aiming to deceive users into believing it's a legitimate resource for protecting their crypto portfolios. The page title, "Ledger Live: Protect Your Crypto Portfolio & Wallet App | Official Guide," is crafted to lure users into a false sense of security. The platform risk score of 76 out of 100 highlights the significant threat it poses to users.

Despite only one detection on VirusTotal, the presence of this domain on public blocklists, including PhishDestroy's, underscores its potential danger. Phishing domains like this often exploit the 24-72 hour gap between domain registration and antivirus database updates, allowing them to operate under the radar. PhishDestroy's proactive detection pipeline captures these threats early, providing an advantage over traditional AV vendors. Users should be cautious of domains mimicking trusted brands, especially in the cryptocurrency space, where the stakes are high.