app-ledgr-liv-dwnload[.]pages[.]dev

PhishDestroy has identified app-ledgr-liv-dwnload.pages.dev as a generic phishing domain masquerading as the official Ledger Live download portal. This domain employs a lookalike naming convention to deceive users into downloading malicious software under the guise of cryptocurrency wallet management. No known drainer kit signatures have been detected in this campaign thus far, suggesting a potential early-stage deployment or a minimally sophisticated threat actor. This domain resolves to IP address 172.66.45.39 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy to unsuspecting users. VirusTotal currently reports 0 detections out of 95 scanning engines, and the domain is not flagged by Google Safe Browsing. The creation date remains unverified at this stage, but the lack of detections indicates a freshly launched or carefully crafted threat. No blocklist entries have been recorded as of this advisory. The domain remains active and under investigation, with no immediate remediation actions taken by hosting providers or security vendors. Users are strongly advised to avoid downloading any software from this domain and to verify the authenticity of Ledger Live downloads directly from the official Ledger website. The current risk level is classified as under_investigation, but the potential for credential theft or malware deployment remains significant. Security teams should monitor this domain for changes in behavior and update blocklists accordingly.