lleedger-live-web[.]pages[.]dev

lleedger-live-web.pages.dev is an active phishing domain posing as the legitimate Ledger Live web interface, designed to steal cryptocurrency from unsuspecting users. This domain employs a generic phishing kit to mimic the official Ledger platform, tricking victims into entering their seed phrases or private keys. The threat actor behind this campaign leverages Cloudflare Pages to host the fraudulent site, ensuring rapid deployment and evasion of traditional detection mechanisms. The drainer kit appears to be a low-sophistication clone, relying on urgency and social engineering rather than advanced technical evasion.

This domain was flagged by PhishDestroy’s automated systems with a VirusTotal detection score of 12/95, indicating it remains undetected by most antivirus engines as of the latest scan. Registered through Cloudflare, Inc., the domain resolves to IP address 188.114.97.3, a Cloudflare-hosted endpoint commonly abused for phishing due to its legitimate appearance and high reputation. The domain is newly registered and has not yet been blacklisted by Google Safe Browsing (GSB) or major threat intelligence platforms, leaving users vulnerable to exposure.

The current status of this threat is active, with the domain still accessible and likely in active use by cybercriminals. PhishDestroy has issued an under-investigation alert and is tracking this domain via seed 74e381 for rapid takedown coordination. While the immediate risk is elevated due to zero detections, users can mitigate exposure by verifying URLs, using hardware wallets, and avoiding web-based seed phrase entry. The remaining risk is moderate, as the domain’s Cloudflare hosting and low detection rate suggest it may remain operational until reported and blocked by major platforms.