learn-live-ledgar[.]pages[.]dev

PhishDestroy identifies learn-live-ledgar.pages.dev as an active fake-login domain designed to harvest cryptocurrency wallet credentials and seed phrases. This site masquerades as a legitimate authentication portal, specifically targeting users expecting to log in to a crypto service or platform. The page leverages a deceptive subdomain structure (pages.dev) to appear authentic while hosting a malicious JavaScript payload intended to capture sensitive input such as private keys or recovery phrases. Security researchers note a high risk of irreversible financial loss once credentials are submitted, as threat actors can immediately drain associated wallets or initiate unauthorized transactions. This domain was flagged by PhishDestroy’s automated pipeline using seed 78c65a, which correlates behavioral indicators with known stealer campaigns. The infrastructure hosts the page behind Google Trust Services SSL (valid certificate), registered through Cloudflare and resolving to IP 172.66.44.253. VirusTotal currently records 0 detections out of 95 scanners, indicating it remains under the radar of most antivirus engines. The domain was observed resolving within the last 48 hours, suggesting a recently deployed campaign with low dwell time to evade detection. If you visited this site or entered any credentials, assume compromise immediately. Disconnect any connected wallets, transfer remaining assets to a newly generated, isolated wallet, and revoke any permissions granted to unknown or suspicious domains. Run a full system scan using an up-to-date antivirus tool and consider rotating passwords or recovery phrases used on crypto platforms. Report the domain to PhishDestroy’s threat intel team using the seed 78c65a for further analysis and community-wide blocking. Do not re-enter sensitive data until the domain has been independently verified as safe by a trusted security service.