# PhishDestroy threat dossier — eng-ledger-lives.pages.dev ================================================================ Fetched: 2026-04-25 19:16:33 UTC Canonical: https://phishdestroy.io/domain/eng-ledger-lives.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Ledger ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, Kaspersky, LevelBlue ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.66.47.192 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Cloudflare, Inc. Nameservers: anirban.ns.cloudflare.com, sandra.ns.cloudflare.com Registered: 2026-04-18 Page title: Ledger Live - Secure Crypto Management HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-07-10 Status: INVALID chain Fingerprint: 622129337836ded7cf8f1315a31c023c2e50f951b71751aefb88daaf6b8292ff ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-18 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-18 18:15:11 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:10:20 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019da128-312c-719d-80c9-b9ce90f57f48/ Wayback Machine: https://web.archive.org/web/*/eng-ledger-lives.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.eng-ledger-lives.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=eng-ledger-lives.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/eng-ledger-lives.pages.dev URLhaus: https://urlhaus.abuse.ch/host/eng-ledger-lives.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-18 18:15:58 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies eng-ledger-lives.pages.dev as an active brand impersonation domain targeting Ledger users. This Cloudflare-hosted page is under investigation as a potential crypto drainer designed to harvest wallet credentials and drain digital assets. The threat is classified as high-risk due to its use of legitimate infrastructure to deceive users into entering sensitive recovery phrases or private keys. Technical indicators reveal a Google Trust Services SSL certificate, resolving to IP 172.66.47.192, which adds superficial credibility. While VirusTotal currently shows 0 detections across 95 engines, this low score does not reflect actual safety and should not be trusted as a validation method. This domain was flagged through Cloudflare, registered under normal parameters, and currently shows no presence on major blocklists despite its malicious intent. The SSL certificate issued to a Google subdomain (likely *.pages.dev) creates a false sense of security, while the impersonation of Ledger—a leading hardware wallet brand—suggests a targeted campaign against cryptocurrency holders. Technical analysis confirms the domain is newly active, with infrastructure mirroring legitimate Ledger support pages to maximize deception. The lack of detections on VirusTotal highlights the evolving nature of this threat, which often bypasses signature-based detection until widespread user reports emerge. To mitigate risk, users must avoid interacting with this domain entirely. Ledger users should only access official support through ledger.com or verified Ledger domains ending in .ledger.com. If credentials or recovery phrases were entered, immediately transfer assets to a new wallet and revoke any connected permissions. Report this domain to PhishDestroy for community-wide blocking, and monitor wallet transactions for unauthorized activity. Never trust domains hosted on unfamiliar platforms like pages.dev when seeking Ledger support, as legitimate services only use official branded domains. Always verify URLs through multiple sources before entering sensitive information. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 622129337836ded7cf8f1315a31c023c2e50f951b71751aefb88daaf6b8292ff ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/eng-ledger-lives.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=eng-ledger-lives.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io