lleddger-live[.]pages[.]dev

PhishDestroy identifies lleddger-live.pages.dev as a live crypto drainer impersonating Ledger devices. This domain is currently active and under investigation for credential theft and crypto-asset exfiltration. The threat actor leverages brand impersonation to deceive users into connecting compromised wallets or revealing seed phrases.

This domain was flagged by 1 of 95 VirusTotal vendors at the time of analysis. It was registered through Cloudflare, Inc., resolving to IP 172.66.47.177. The SSL certificate is issued by Google Trust Services, which may contribute to its legitimate appearance. No historical blocklist detections were recorded at the time of assessment, though this domain remains untrusted due to its malicious indicators.

Given the active status and zero detection rate, PhishDestroy recommends immediate network-wide blocking of lleddger-live.pages.dev and its associated IP (172.66.47.177). Users should be alerted to avoid interacting with any Ledger-branded domains outside of official channels. Security teams should monitor for outbound connections to this domain and inspect DNS logs for resolution attempts. Threat hunting queries should include IOCs such as the domain’s unique seed (2f0343) and SSL issuer metadata.