live--ladger-tezor[.]pages[.]dev

PhishDestroy identifies live--ladger-tezor.pages.dev as a deceptive domain actively impersonating Ledger crypto wallet login pages to harvest seed phrases and drain funds. The site leverages Cloudflare Pages hosting (via Cloudflare, Inc.) to deploy a lookalike interface that closely mirrors legitimate Ledger interfaces, tricking users into revealing sensitive recovery phrases or private keys. This domain was flagged as part of a broader trend of crypto wallet phishing campaigns targeting users through typosquatting and impersonation tactics.

Investigation reveals critical technical details supporting its malicious nature. VirusTotal scans currently show 0 detections out of 95 engines, indicating evasion of signature-based detection. The domain resolves to IP 188.114.97.3 (Cloudflare infrastructure) and utilizes a Google Trust Services SSL certificate to appear legitimate. Registered through Cloudflare’s infrastructure, this domain exhibits characteristics common to short-lived phishing operations, including lack of historical blocklist entries and rapid deployment cycles.

Users who visited this domain should immediately disconnect from the internet and check for unauthorized transactions in their crypto wallets. If seed phrases or private keys were entered, transfer remaining funds to a newly generated wallet and revoke any connected app permissions via Ledger Live. Report the incident to Ledger support and PhishDestroy while scanning local devices for malware. Avoid interacting with similar domains and always verify URLs through PhishDestroy’s verification tool before entering credentials.