site-ledgrlive-eng[.]pages[.]dev

PhishDestroy identifies site-ledgrlive-eng.pages.dev as an active crypto drainer impersonating Ledger Live. The domain employs brand impersonation to trick users into connecting malicious wallet connectors that drain crypto assets. The threat is classified as under_investigation due to evolving payload analysis, but preliminary evidence confirms wallet-draining functionality. This domain was flagged via automated monitoring and is registered through Cloudflare, Inc. using Google Trust Services for SSL. VirusTotal currently shows 3/95 antivirus engines detecting the threat, indicating it remains under the radar. The site resolves to IP 172.66.47.169, hosted within Cloudflare’s infrastructure. No public blocklists currently flag the domain, and creation date analysis suggests recent deployment targeting Ledger users. Trust scores across threat intelligence platforms remain uncalculated due to novelty, increasing risk for unprotected users. Mitigation requires immediate action: disconnect from the site, revoke any wallet connections made, and block the domain at network and endpoint levels. Users should verify Ledger Live endpoints via official channels only. Organizations should deploy DNS filtering to block 172.66.47.169 and monitor for outbound connections to this IP. Always use hardware wallets and avoid connecting to third-party wallet connectors without verification. Update threat intelligence feeds to include this domain using seed e472cb for ongoing tracking.