access-liveledgr-apps[.]pages[.]dev

PhishDestroy identifies access-liveledgr-apps.pages.dev as a live Ledger brand impersonation domain designed for crypto drainer operations. This malicious domain mimics official Ledger Live application hosting to trick users into connecting crypto wallets under false pretenses. The threat actor leverages Cloudflare Pages hosting and a Google Trust Services SSL certificate to appear legitimate, but the domain was registered through Cloudflare, Inc. and resolves to IP 188.114.96.3. With 0 detections on VirusTotal (7/95 engines), this phishing infrastructure remains under the radar while actively harvesting wallet credentials and crypto assets. This domain was flagged by PhishDestroy’s automated analysis pipeline using seed 3b84af, identifying it as a brand impersonation threat targeting Ledger hardware wallet users. The infrastructure shows recent deployment characteristics with Cloudflare Pages hosting and Google-issued SSL certificates, which are commonly abused to bypass traditional security controls. While the exact creation date is not publicly disclosed, the domain’s association with active phishing campaigns and zero detection rate on VirusTotal (7/95) indicates a high-risk, evasive threat actor operation. Security researchers should monitor this domain for further IOC expansion. Users who visited access-liveledgr-apps.pages.dev should immediately disconnect any connected wallets, revoke any granted permissions through their wallet’s connected app interface, and transfer remaining assets to a new wallet. Do not interact with any prompts or transaction requests from this domain. Report the domain to your wallet provider and consider running a malware scan on any device used to access this site. Block the domain at DNS/network level using reputable threat intelligence feeds to prevent further exposure.