live-leddger-walat-eng[.]pages[.]dev

PhishDestroy classifies the domain live-leddger-walat-eng.pages.dev as an active Ledger wallet phishing site designed to harvest private keys and seed phrases. The elevated risk stems from its use of Cloudflare pages to impersonate a legitimate Ledger interface, tricking users into entering recovery phrases under the guise of wallet updates. This specific campaign targets cryptocurrency holders by mimicking the official Ledger Live interface, a common social-engineering tactic used to siphon digital assets from unsuspecting victims. This domain was flagged by PhishDestroy after VirusTotal returned a detection ratio of 1/95 security vendors flagging the page, indicating near-universal consensus among leading scanning engines. The registrar is Cloudflare, Inc., which hosts the fraudulent page on IP 172.66.47.102 and supplies a Google Trust Services SSL certificate to lend false legitimacy. The page was detected through automated crawling and has not yet appeared on public blocklists, suggesting a recently activated campaign. The use of a .pages.dev subdomain under an engineered “walat-eng” prefix is intended to bypass simple domain-based filters. To mitigate exposure to this Ledger wallet phishing site, users should avoid clicking any links purporting to be Ledger Live update notices and should only download software from ledger.com. Verify URLs by hovering links and confirm SSL certificates match Ledger’s official domains. Block the IP 172.66.47.102 at the network perimeter and report the domain to Google Safe Browsing and PhishDestroy to hasten takedown. Cryptocurrency holders are advised to revoke any keys exposed on this page and migrate remaining funds to a newly generated wallet on verified hardware.