live-ladger-us[.]pages[.]dev

live-ladger-us.pages.dev has been identified as a live crypto wallet drainer phishing domain under active investigation. The site mimics legitimate cryptocurrency services to trick users into connecting their wallets and signing malicious transactions. No specific brand impersonation or drainer kit has been confirmed at this time, but the domain’s structure and SSL certificate suggest a well-constructed phishing attempt targeting digital asset holders. The presence of a Google Trust Services SSL certificate indicates an attempt to appear legitimate, a common tactic among recent phishing campaigns.

This domain resolves to IP address 172.66.44.177 and is registered through Cloudflare, Inc., with a VirusTotal detection score of 0/95 as of the latest scan. The domain does not appear on Google Safe Browsing (GSB) lists, and no public blocklist entries are currently associated with it. The technical infrastructure leverages Cloudflare’s services, which are frequently abused by threat actors to host phishing pages due to their reliability and evasion capabilities against takedown efforts. The domain’s use of a Google-hosted subdomain (pages.dev) further complicates detection and blocking for end users.

As of now, the domain remains active with an under-investigation risk status. No takedown actions have been executed, leaving users exposed to potential credential and cryptocurrency theft. PhishDestroy recommends immediate caution when encountering this domain or any unsolicited links referencing it. Users should verify URLs through official channels and avoid entering wallet credentials or signing transactions without thorough validation. Blocking the IP 172.66.44.177 at the network level may reduce exposure. Further analysis is ongoing to determine the full scope of this campaign and associated infrastructure.