ledger-wallet-en-live[.]pages[.]dev

PhishDestroy identifies ledger-wallet-en-live.pages.dev as an active brand-impersonation site masquerading as the official Ledger crypto wallet service. This fraudulent domain uses Cloudflare hosting and a Google Trust Services SSL certificate to appear legitimate, while the underlying infrastructure (IP 172.66.46.228) is already being investigated for delivering a crypto asset drainer that silently siphons funds from connected wallets. The domain was flagged by PhishDestroy with a dynamic threat score of “under_investigation,” exhibiting zero detections on VirusTotal out of 95 engines at time of analysis. Registrar data indicates Cloudflare, Inc. as the listed host, leveraging Pages.dev for rapid deployment. The site’s recent activation window (seed 81c5f8) suggests it was stood up specifically to capitalize on user trust in the Ledger brand. Users who visited ledger-wallet-en-live.pages.dev should immediately disconnect any wallets, revoke connected app permissions via Ledger Live or your hardware wallet’s interface, and run a comprehensive malware scan using reputable antivirus tools. Report the domain to Ledger’s official phishing inbox and consider rotating all wallet seed phrases on an offline device to pre-empt any unauthorized transfers.