ldgr-livee-download[.]pages[.]dev

PhishDestroy identifies ldgr-livee-download.pages.dev as an active crypto drainer scam impersonating the official Ledger Live download portal. The domain leverages Cloudflare Pages to host a fraudulent installer designed to siphon cryptocurrency assets from victims who download and execute the malicious payload. Behavioral analysis suggests the drainer kit is preconfigured to target Ledger hardware wallet users, though it may expand to other brands. The infrastructure is optimized for evasion, using legitimate cloud hosting to blend in with benign services while delivering the exploit payload.

This domain resolves to IP address 172.66.44.77 and is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating a low profile on public threat intelligence platforms. While the domain is not yet flagged in Google Safe Browsing (GSB) or major blocklists, its recent creation and suspicious content suggest it is actively evading detection. The combination of Cloudflare’s fast-flux hosting, Google-issued SSL, and zero detections highlights a sophisticated, low-signature operation aimed at bypassing automated defenses.

Currently, ldgr-livee-download.pages.dev remains active despite its malicious intent, with no takedown actions observed. PhishDestroy’s automated systems continue to monitor the domain for behavioral anomalies, while manual analysis confirms its role in crypto drainer campaigns. The residual risk is high due to the domain’s legitimate infrastructure and lack of blocklist coverage. Users are strongly advised to avoid downloading files from this domain and to verify any Ledger Live downloads via official sources. Immediate reporting to PhishDestroy is recommended to accelerate detection and mitigation efforts.