liv-ledgr-eng[.]pages[.]dev

PhishDestroy has flagged liv-ledgr-eng.pages.dev as a live phishing domain masquerading as the legitimate Ledger Live crypto wallet interface. This generic phishing campaign targets cryptocurrency users by impersonating a trusted brand’s login portal, aiming to harvest wallet credentials and seed phrases. No specific drainer kit variant has been confirmed at this stage, but the domain’s structure and SSL certificate suggest a recent, rapidly deployed operation designed to evade static detection.

This domain resolves to IP 172.66.44.211 and is registered through Cloudflare, Inc. It currently shows 0 detections out of 95 on VirusTotal, indicating it remains under the radar of most automated scanners. The SSL certificate is issued by Google Trust Services, which does not automatically signify legitimacy—attackers commonly abuse trusted issuers to appear authentic. No blocklist entries were observed at the time of analysis, and the domain’s creation date and Google Safe Browsing (GSB) status are still under investigation.

The domain remains active and poses a high risk to unsuspecting users, particularly those seeking Ledger Live services. PhishDestroy has flagged this threat for immediate takedown coordination with Cloudflare and Google Trust Services. Users are advised to avoid interacting with the domain, verify URLs manually, and consult official Ledger communication channels. While the immediate threat is being mitigated, the low detection rate (5/95) and abuse of reputable infrastructure elevate the risk level. Continuous monitoring is required until the domain is fully neutralized and added to blocklists.