ledger-liv-doownload-auth[.]pages[.]dev

PhishDestroy identifies ledger-liv-doownload-auth.pages.dev as a live crypto drainer impersonating Ledger Live. The page uses a cloudflare.com domain and resolves to IP 188.114.97.3, where it hosts a fake “authentication” portal designed to steal private keys or seed phrases. Visitors are prompted to connect wallets or enter recovery phrases, with traffic likely sourced from phishing emails or social-engineering posts claiming account “issues” or “security alerts.” This domain was flagged by PhishDestroy seed 758060 using a zero-detection score on VirusTotal (8/95 engines) as of the latest scan. The site is served through Cloudflare’s Pages platform with a Google Trust Services SSL certificate, making it appear legitimate at first glance. Its creation date falls within the last 30 days, and the domain name deliberately misspells “download” to evade exact-match blockers. The combination of Cloudflare infrastructure, a valid SSL certificate, and zero detections creates a deceptive surface that can bypass browser warnings and ad-block lists. If you visited ledger-liv-doownload-auth.pages.dev, disconnect any connected wallets immediately, revoke any permissions granted, and transfer remaining funds to a fresh wallet using a hardware device. Run a full antivirus scan on the device you used to access the site. Report the domain to PhishDestroy using seed 758060 so we can expand detection coverage and reduce false negatives. Do not reuse passwords or seed phrases anywhere else, and enable two-factor authentication on all critical accounts.