public-ledgrlive-eng[.]pages[.]dev

public-ledgrlive-eng.pages.dev has been flagged with a specific credential-harvesting threat targeting Ledger Live users. The site mimics the official portal to trick victims into surrendering wallet access. An active investigation places the domain’s risk level at under_investigation while indicators align with a high-fidelity phishing kit designed to drain crypto holdings.

PhishDestroy’s analysis ties the domain to 0 detections on VirusTotal out of 95 engines as of this scan, while infrastructure details reveal registration via Cloudflare, Inc. and resolution to IP 188.114.96.3. The use of Google Trust Services for SSL further underscores an attempt to obfuscate malicious intent. With no current placement on known blocklists and minimal community reporting, this domain remains a stealthy but active threat.

Organizations should immediately block egress traffic to 188.114.96.3 and flag all subdomains under pages.dev containing the string ledgrlive-eng. Users who accessed this page should revoke any entered credentials and rotate wallet passwords in a clean, offline environment. Consider scope expansion: hunt for downstream crypto-mixing or C2 callbacks tied to 188.114.96.3 to uncover broader compromise beyond the initial lure.