eu-ledger-live-io[.]pages[.]dev

PhishDestroy identifies eu-ledger-live-io.pages.dev as an active brand-impersonation domain currently under investigation for distributing a cryptocurrency drainer kit targeting Ledger users. The domain uses Cloudflare Pages hosting and a Google Trust Services SSL certificate to appear legitimate, while resolving to IP 172.66.47.170. The threat is classified as a high-risk impersonation due to its direct mimicry of Ledger’s official branding and infrastructure designed to deceive cryptocurrency holders.

Technical indicators confirm this domain remains undetected by 95 security vendors according to VirusTotal, indicating low detection coverage despite clear malicious intent. Registered through Cloudflare, Inc., it leverages Google Trust Services for SSL authentication, adding perceived legitimacy. The domain’s IP address 172.66.47.170 correlates with known phishing infrastructure, and while the exact registration date is not disclosed, its active status suggests recent deployment. Current blocklist counts remain unspecified, but the absence of detections highlights a gap in threat intelligence coverage.

This domain is currently active and flagged as under investigation, with no confirmed takedown as of the latest analysis. Security teams are advised to monitor for associated wallet addresses and drainer signatures. Users are strongly urged to verify this domain via PhishDestroy before engaging, as the combination of zero detections, Ledger impersonation, and crypto-focused lures poses a severe risk to cryptocurrency assets. Remaining risk is classified as high due to the drainer’s potential to execute unauthorized transactions.