# liv-ledeger.pages.dev — SUSPICIOUS

> Domain liv-ledeger.pages.dev operates a crypto drainer phishing site. Detected by 0/95 VirusTotal engines—act now to protect your crypto assets.

## Summary
PhishDestroy identifies the domain liv-ledeger.pages.dev as an active crypto drainer posing under the guise of a legitimate ledger service. This site is engineered to trick users into connecting their cryptocurrency wallets and unknowingly approve malicious transactions that drain funds directly. The threat is sophisticated, leveraging deceptive pages.dev subdomains to appear credible while hosting drainer scripts that execute unauthorized transfers once wallet permissions are granted. Users who interact with this domain risk immediate financial loss, as drainers are designed to exploit wallet signatures and approval mechanisms without requiring additional credentials.  This domain was flagged by PhishDestroy after analysis revealed key indicators of compromise. VirusTotal reports a clean scan with 0 detections out of 95 engines as of the latest check, highlighting how new or evasive threats can evade detection. The domain is registered through Cloudflare, Inc., known for its privacy protections, and resolves to IP 188.114.96.3, a Cloudflare IP range often abused by threat actors to mask their infrastructure. Additionally, the use of pages.dev—a legitimate Vercel domain—further complicates blocking efforts, as it blends in with benign developer activity. These factors combine to create a stealthy attack vector that requires proactive user vigilance.  If you visited liv-ledeger.pages.dev or clicked on links from this domain, assume your wallet may have been compromised. Immediately revoke any active permissions granted to the site using your wallet’s connection manager or app settings. Transfer any remaining funds to a new, isolated wallet not linked to the compromised one. Monitor transaction history for unauthorized activity and consider using hardware wallets with transaction approval mechanisms for enhanced security. Report the domain to your wallet provider and relevant authorities to help block future access.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/fa185f07-2d46-4948-b6a3-ad290d6fcc1c
- PhishDestroy: https://phishdestroy.io/domain/liv-ledeger.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/liv-ledeger.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/liv-ledeger.pages.dev/
Last updated: 2026-03-23