net-leddger-live[.]weebly[.]com

PhishDestroy identifies net-leddger-live.weebly.com as a generic phishing domain under active investigation for impersonating Ledger Live and deploying a crypto drainer kit. The site leverages a Weebly subdomain to mimic the official Ledger Live interface, tricking users into entering wallet credentials or connecting malicious smart contracts that drain crypto assets. This mimicry capitalizes on Ledger’s brand recognition to maximize victim engagement and illicit fund extraction. This domain was flagged with a VirusTotal detection score of 1 out of 95 engines at time of analysis, indicating it remains under the radar of most antivirus and threat intelligence platforms. It was registered through MarkMonitor Inc. on March 29, 2006, and resolves to IP address 74.115.51.9. The domain holds a valid Let's Encrypt SSL certificate, increasing its legitimacy appearance. As of now, it has not been added to Google Safe Browsing (GSB) and remains unblocked by major security vendors, increasing exposure to potential victims. The threat is currently active with a status of 'under_investigation' and a unique seed identifier of f16081. PhishDestroy continues to monitor the domain and has flagged it for immediate takedown outreach to the hosting provider and registrar. While the immediate risk is elevated due to low detection rates and SSL validation, users are strongly advised to verify any Ledger Live-related links via PhishDestroy’s real-time verification tool. Remaining risk includes continued exposure to unsuspecting users and potential escalation into a larger phishing campaign. No active takedown has been confirmed yet.