cdn-liveledgr-io[.]pages[.]dev

PhishDestroy identifies the active crypto drainer domain cdn-liveledgr-io.pages.dev using a spoofed Ledger interface to steal cryptocurrency assets. This Pages.dev subdomain hosts a malicious drainer kit disguised as a ‘live’ Ledger CDN endpoint, specifically engineered to intercept wallet connections and authorize unauthorized transfers. The infrastructure is configured to mimic legitimate CDN assets, leveraging the Pages.dev platform to evade traditional email filtering while maintaining a convincing HTTPS origin via Google Trust Services certificates. The domain’s naming convention ‘liveledgr’ is a deliberate typosquat of ‘Live Ledger,’ aiming to capitalize on brand confusion among users seeking official firmware or software updates. This domain exhibits several red flags confirmed by PhishDestroy’s forensic analysis. VirusTotal currently flags this URL with 0 detections out of 95 engines, indicating zero coverage in major threat intelligence feeds as of assessment time. The domain is registered through Cloudflare, Inc., a common choice for threat actors due to its masking of underlying registrant data via proxy services. The domain resolves to the IP address 172.66.47.156, a Cloudflare-operated edge node shared across multiple legitimate and malicious sites. The SSL certificate is issued by Google Trust Services under the *.pages.dev wildcard, which is standard for Pages.dev domains and does not inherently indicate malicious intent. At this time, PhishDestroy has not observed this domain on any public blocklists or threat feeds, underscoring its novelty and the need for proactive user education. As of Seed 223965, cdn-liveledgr-io.pages.dev remains active and unblocked by mainstream defenses. PhishDestroy has flagged this domain as a high-priority threat due to its active drainer functionality and impersonation of a trusted hardware wallet brand. Users are advised to avoid accessing this domain and verify any Ledger-related links via the official ledger.com domain only. The domain poses a severe risk to users who interact with wallet interfaces served from untrusted CDN endpoints, particularly those involving cryptocurrency transactions. Remaining risk is assessed as elevated given the lack of detection coverage and the domain’s use of reputable infrastructure to host malicious content. Ongoing monitoring for related infrastructure expansion and additional domains is in progress.