live-wallet-ledger[.]pages[.]dev

PhishDestroy identifies live-wallet-ledger.pages.dev as an active crypto drainer domain masquerading as a Ledger wallet interface. The site exploits trust in hardware wallet branding to trick users into connecting crypto wallets, where a drainer kit silently initiates unauthorized transfers upon wallet interaction. Initial telemetry suggests this campaign targets users searching for ‘live wallet ledger’ or similar terms, redirecting them through cloaked URLs to harvest private keys or sign malicious transactions. live-wallet-ledger.pages.dev is registered via Cloudflare, Inc., resolving to IP 188.114.96.3. The domain carries a Google Trust Services SSL certificate (valid), yet garners 0 detections across 95 VirusTotal scanners. This site was created recently and remains unlisted on major blocklists such as Google Safe Browsing (GSB) as of review time. Despite low detection rates, behavioral analysis confirms active exploitation of wallet connection prompts, a hallmark of drainer-as-a-service (DaaS) toolkits observed in recent phishing campaigns. This domain is currently active and under continuous monitoring. Blocking at the network level is recommended via firewall rules targeting 188.114.96.3 and domain-level DNS sinkholing for live-wallet-ledger.pages.dev. While the immediate risk is high for users encountering the page, the lack of GSB flagging and low VT score indicate this campaign is still in early deployment. Users are advised to avoid unsolicited wallet connection requests and verify all URLs against official sources before interacting.