leige-rd-live-learn[.]pages[.]dev

PhishDestroy identifies an active Ledger brand impersonation phishing campaign operating at leige-rd-live-learn.pages.dev that poses a direct risk to cryptocurrency users. This domain hosts a spoofed interface designed to deceive visitors into connecting their Ledger hardware wallet or entering seed phrases, enabling threat actors to drain cryptocurrency assets silently. The site leverages Ledger’s branding to appear legitimate, targeting users seeking wallet management or transaction services. Cloudflare’s Pages platform is being abused to host the malicious content, increasing the campaign’s credibility due to the trusted infrastructure. This domain was flagged by only 1 out of 95 security vendors on VirusTotal, indicating low detection coverage despite its malicious intent. It was registered through Cloudflare, Inc., a common choice for threat actors seeking anonymity and rapid deployment. The domain resolves to IP address 188.114.97.3 and is secured with a Google Trust Services SSL certificate, further enhancing its appearance of legitimacy. The campaign is currently active and represents an elevated threat level due to its focus on cryptocurrency theft and its use of trusted infrastructure. If you visited leige-rd-live-learn.pages.dev, disconnect your Ledger device immediately and revoke any permissions granted. Do not enter your recovery phrase or share wallet details. Use PhishDestroy to verify the legitimacy of any Ledger-related links. Report this domain to Ledger’s official security team and monitor your wallets for unauthorized transactions. Always access Ledger services directly through ledger.com or your official app to avoid similar threats.