acces-live-ledger[.]pages[.]dev

PhishDestroy has identified a live crypto drainer at acces-live-ledger.pages.dev that mimics Ledger Live to trick users into connecting cryptocurrency wallets, allowing attackers to silently drain funds. The site lures victims under the guise of a legitimate Ledger Live portal, prompting wallet connections that grant unauthorized transaction permissions. Once connected, the drainer executes transfers without further user interaction, exposing deposited assets to immediate theft. Users should treat any unexpected Ledger Live link with extreme caution and verify endpoints before entering credentials or connecting wallets. This threat is not theoretical—it is an active campaign designed to intercept private keys and seed phrases.

This domain was flagged by PhishDestroy after cross-referencing multiple threat feeds, revealing zero detections on VirusTotal with 95 engines scanned as of June 2024. The site resolves to 172.66.47.148 via Cloudflare, Inc., leveraging Google Trust Services for SSL certificates to appear legitimate. Despite its polished appearance, the domain remains unsigned by Ledger and uses a Cloudflare Pages subdomain structure uncommon in official Ledger infrastructure. Registrar data shows recent creation, aligning with the observed campaign timeline and rapid deployment tactics favored by drainer operators.

If you visited acces-live-ledger.pages.dev, immediately disconnect your wallet, revoke any unauthorized permissions in your wallet settings, and transfer remaining funds to a newly created wallet with a different seed phrase. Scan your device for malware using reputable antivirus tools, change passwords on all crypto-related accounts, and report the incident to PhishDestroy for further analysis. Avoid entering seed phrases or private keys on any site claiming to be Ledger Live unless you have verified the exact URL via Ledger's official website. Always use hardware wallet verification steps and multi-factor authentication to mitigate future risks.