leaderliveapp[.]pages[.]dev

PhishDestroy flags leaderliveapp.pages.dev as a brand-impersonation domain targeting Ledger cryptocurrency wallet users. The site is actively resolving to IP 172.66.44.143 and currently shows 0/95 VirusTotal detections, indicating it has evaded automated scanning engines. The domain leverages Cloudflare Pages infrastructure and a Google Trust Services SSL certificate to appear legitimate, increasing the likelihood of credential theft or malware delivery under the guise of a Ledger service portal. The indicators collectively reinforce a high-fidelity impersonation campaign. The domain is registered through Cloudflare, Inc., a common choice for threat actors seeking CDN-backed evasion, and resolves to a Cloudflare edge IP in San Francisco (172.66.44.143). The SSL certificate, issued by Google Trust Services under the “GTS CA 1C3,” adds a veneer of authenticity, tricking users into believing the site is secure. With 0 detections across 95 scanning engines on VirusTotal, this domain has not yet been widely blacklisted, allowing it to remain active and accessible. Brand impersonation of Ledger is particularly dangerous due to the irreversible financial consequences of exposing recovery phrases or private keys. To mitigate risk, users must treat any unsolicited Ledger-related link—especially those hosted on third-party domains like pages.dev—with extreme caution. Never enter your 24-word seed phrase or private keys on any site not directly accessed via the official Ledger Live application or ledger.com domain. Verify all URLs manually by comparing them to the official Ledger website and use browser extensions that detect impersonation pages. Report suspected impersonations to Ledger’s official phishing inbox and block the domain at the network level if possible. Always enable hardware wallet confirmation for transactions to prevent silent fund transfers.