ledger-liveportal[.]web[.]app

PhishDestroy identifies active brand impersonation via the domain ledger-liveportal.web.app that closely mimics the official Ledger Live wallet portal to trick users into entering private keys and seed phrases. This site masquerades as the legitimate crypto wallet application, creating a high-risk lures for cryptocurrency theft. The landing page title “Ledger Live Crypto Wallet App | Ledger” is used to reinforce the fraudulent identity, leveraging Ledger’s brand authority to deceive visitors into surrendering sensitive wallet data.

Technical indicators confirm suspicious infrastructure: the domain resolves to IP 199.36.158.100, is registered through Google LLC via Google Trust Services, and currently shows 18/95 detections on VirusTotal—indicating undetected malicious content. The SSL certificate issued by Google Trust Services lends an air of legitimacy, while the domain’s recent creation and low detection rate suggest a newly deployed fraudulent endpoint. Google Safe Browsing (GSB) status remains unflagged at this time, and no public blocklist entries have been recorded yet.

Current status remains active with ongoing threat monitoring. Response actions include domain takedown requests submitted to Google LLC and escalation to Ledger’s abuse team for immediate deactivation. Despite these efforts, the domain remains accessible and unblocked, posing a measurable risk to users who may attempt to download or access Ledger Live services via this fraudulent route. Users are strongly advised to verify all URLs through official channels and avoid entering credentials or seed phrases on untrusted domains. Remaining risk is assessed as high due to active availability and undetected status on major threat platforms.