ledgr-io-up[.]pages[.]dev

This domain, ledgr-io-up.pages.dev, is flagged as a high-risk crypto wallet drainer specifically targeting users of the Ledger hardware wallet ecosystem. Analysis indicates the site impersonates the official Ledger Live platform, presenting itself as a tutorial resource titled 'Ledger Live Tutorial: Setup to Advanced Features.' The objective appears to be the deployment of malicious scripts designed to siphon cryptocurrency assets from victims' wallets upon interaction, a tactic consistent with recent crypto drainer campaigns observed in the wild. Infrastructure analysis reveals the domain was registered on April 30, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.74, geolocated to California. The domain is secured with an SSL certificate issued by Google Trust Services (WE1), a common obfuscation technique to lend an air of legitimacy. Detection metrics from VirusTotal indicate that 7 out of 95 security vendors have flagged the domain as malicious, while it appears on at least one security blocklist. Notably, the domain remains operational despite these detections, suggesting either delayed takedown efforts or deliberate evasion tactics. Current status assessment confirms the domain remains active as of this analysis, posing an ongoing threat to users who may be deceived by its branding. Response actions by security entities such as PhishDestroy have resulted in partial blocking, though the domain's persistence underscores the need for broader mitigation. Users are advised to exercise extreme caution when interacting with unsolicited wallet-related resources, particularly those hosted on non-official domains. Verification of domain authenticity through official channels and the use of hardware wallet security features are strongly recommended to mitigate the risk of asset compromise.