en-live-ladger[.]pages[.]dev

PhishDestroy identifies en-live-ladger.pages.dev as an active crypto drainer posing as a Ledger wallet, posing significant risks to cryptocurrency users. The domain leverages deceptive branding and trusted infrastructure to trick victims into connecting fraudulent wallet interfaces, enabling unauthorized token transfers. Initial analysis places this domain under investigation with an elevated risk level requiring immediate attention. This domain is registered through Cloudflare, Inc., resolving to IP 172.66.47.7 with a Google Trust Services SSL certificate. VirusTotal currently shows 0 detections out of 95 scanners, indicating low initial detection rates despite clear malicious intent. The domain uses Cloudflare Pages for hosting, which provides additional legitimacy through CDN infrastructure while masking true origin. Notably, the page.dev subdomain suggests an attempt to exploit legitimate development platform branding. No known blocklist entries exist at this time, though the domain's recent creation likely contributes to this gap. Immediate action requires blocking the domain at DNS and network levels while investigating any recent cryptocurrency transactions linked to wallet connections. Users should be warned against interacting with Ledger-themed domains outside official channels (ledger.com). Organizations should update firewall rules to block 172.66.47.7 while monitoring for similar domains using .pages.dev TLDs. Enhanced monitoring of wallet connection signatures and blockchain analysis should prioritize this domain until comprehensive takedown occurs.