ladger-live-en-us[.]pages[.]dev

PhishDestroy identifies ladger-live-en-us.pages.dev as an active crypto drainer phishing domain impersonating Ledger Live, a popular cryptocurrency wallet service. This domain leverages a deceptive subdomain ('ladger-live-en-us') and Cloudflare’s infrastructure to mimic legitimate Ledger Live pages, tricking users into connecting their wallets or entering seed phrases under the guise of software updates or verification. The threat actor behind this campaign uses Google Trust Services-issued SSL certificates to enhance credibility, making the domain appear legitimate at first glance. Analysis shows the domain resolves to IP 188.114.96.3, a Cloudflare-hosted address commonly abused for phishing operations. At the time of reporting, VirusTotal shows 13/95 detections, indicating a low initial detection rate despite its malicious intent. This underscores the importance of proactive threat intelligence, as traditional antivirus and browser-based defenses may fail to flag such domains promptly. This domain was flagged under PhishDestroy’s generic_phishing category and is currently under investigation, with a status of 'active.' The registrar is Cloudflare, Inc., which is not inherently malicious but is frequently exploited by threat actors due to its privacy protections and rapid deployment capabilities. The domain’s recent creation and lack of historical data further contribute to its stealthiness, as it has not yet been widely reported or blacklisted. While the exact creation date is not provided, the absence of detections on VirusTotal suggests it is either very new or carefully crafted to evade detection. The combination of a legitimate-looking subdomain, Cloudflare hosting, and a trusted SSL certificate creates a convincing facade, increasing the likelihood of successful deception against unsuspecting users. If you have visited ladger-live-en-us.pages.dev or interacted with it, immediately disconnect your wallet from any suspicious connections and revoke any permissions granted to unknown applications. Do not enter your seed phrase, private keys, or any sensitive information on this domain. Scan your device for malware using reputable antivirus software, and consider transferring your assets to a new wallet if you suspect compromise. Report the domain to PhishDestroy and other threat intelligence platforms to aid in blocking efforts. For Ledger users, verify any communication by visiting the official Ledger website directly and cross-referencing URLs. Stay vigilant, as crypto drainers often evolve to mimic other legitimate services.