ledgelive-download[.]pages[.]dev

PhishDestroy identifies the domain ledgelive-download.pages.dev as an active crypto drainer impersonating Ledger Live. The page is currently live and serving malicious content designed to trick users into connecting crypto wallets under the guise of downloading legitimate Ledger software. This campaign specifically targets cryptocurrency holders by mimicking official firmware or application update portals, a common tactic used by threat actors to deploy drainer scripts that siphon digital assets upon wallet connection.

This domain was flagged by 1 of 95 VirusTotal vendors and is registered through Cloudflare, Inc. It resolves to IP address 172.66.45.33 and is secured with a Google Trust Services SSL certificate. While no creation date is publicly listed, the domain is currently active and unlisted on major threat intelligence blocklists. Its low detection rate suggests it may be a recently deployed or highly targeted campaign, flying under the radar of automated scanners intended to evade early detection.

Given the active status and evasive nature of this threat, PhishDestroy recommends immediate avoidance of ledgelive-download.pages.dev and any associated links. Users who may have interacted with this domain should disconnect their wallets, revoke any suspicious token approvals, and scan their systems for malware. Organizations are advised to monitor for unusual outbound connections to 172.66.45.33. Report this domain to your security team and to PhishDestroy using seed 225340 to aid in takedown efforts and protect the broader community.