app-en--ledgr-live-da0[.]pages[.]dev

PhishDestroy has identified app-en--ledgr-live-da0.pages.dev as an active domain involved in a Ledger-themed phishing campaign. The domain presents a deceptive interface mimicking legitimate Ledger services, with the page title 'v — Colorful Presentation' serving as a red flag for users expecting official branding. This specific threat leverages social engineering to trick victims into divulging sensitive cryptocurrency wallet credentials. The risk level remains under investigation due to the potential for rapid evolution in phishing tactics, but the active status demands immediate attention from security teams.

This domain was flagged through PhishDestroy's monitoring pipeline with the following technical indicators: it resolves to IP 172.66.44.193, utilizes Cloudflare as its registrar, and operates under a Google Trust Services SSL certificate. VirusTotal analysis shows 0 detections out of 95 engines, indicating this campaign has evaded traditional signature-based detection mechanisms. The domain remains unlisted on major blocklists as of the latest scans, further highlighting its potential to slip through conventional defenses. The current infrastructure suggests a sophisticated adversary leveraging legitimate cloud services to host malicious content.

Mitigation for this specific Ledger phishing threat requires immediate domain blocking at the network level coupled with user awareness campaigns highlighting the absence of visual branding consistency. Security teams should implement DNS sinkholing for the resolved IP 172.66.44.193 while monitoring for additional infrastructure pivots. Given the 1/95 VirusTotal detection rate, behavioral analysis of network traffic to this domain should be prioritized over reputation-based blocking alone. Organizations should immediately update phishing response playbooks to include this domain as a high-confidence indicator of compromise for Ledger credential harvesting attempts.