public-official-ledgrlive-app[.]pages[.]dev

PhishDestroy identifies public-official-ledgrlive-app.pages.dev as an active phishing domain impersonating the official Ledger Live cryptocurrency wallet application to steal user credentials and funds. The domain employs a generic phishing kit designed to harvest wallet recovery phrases, private keys, and login details under the guise of a legitimate Ledger Live update or verification process. This is a targeted attack on cryptocurrency users, leveraging brand confusion and urgency to deceive victims into entering sensitive information into a fraudulent interface.

This domain was flagged with a VirusTotal detection score of 1 out of 95 security vendors, indicating extremely low detection across scanning engines despite active abuse. It is registered through Cloudflare, Inc., resolving to IP address 172.66.46.223, and holds a valid SSL certificate issued by Google Trust Services. While the creation date is not disclosed, the domain remains active as of the latest assessment. Google Safe Browsing (GSB) has not yet flagged this domain, and no public blocklist entries have been recorded. These technical indicators suggest a recently deployed or stealthily operated campaign.

The domain is currently active and poses an elevated risk due to its phishing design and cryptocurrency targeting. PhishDestroy recommends immediate avoidance and blocking at the network or DNS level. Users who may have interacted with this site should revoke any exposed credentials, transfer assets from affected wallets, and monitor for follow-on phishing or financial exploitation. While the immediate threat can be mitigated through user awareness and technical controls, residual risk remains high for those who have already entered sensitive data. Continuous monitoring and proactive threat intelligence sharing are advised to prevent further compromise.