ladgr-liv-sec-app[.]pages[.]dev

PhishDestroy identifies domain ladgr-liv-sec-app.pages.dev as an active brand impersonation site masquerading as Ledger Live, the official secure wallet application from Ledger SAS. The threat actor leverages Cloudflare Pages to host a near-identical replica of Ledger’s official interface, likely designed to harvest user credentials, seed phrases, or other sensitive wallet-related data. No drainer kit or obfuscated malicious scripts were detected in initial static analysis; however, the page title ('Ledger Live – Secure Wallet App') strongly suggests a social engineering campaign targeting cryptocurrency users familiar with the brand. The use of a legitimate hosting provider (Cloudflare Pages) and a Google Trust Services SSL certificate adds superficial legitimacy, increasing the risk of successful deception among non-technical users.

This domain resolves to IP address 172.66.47.202 and is registered through Cloudflare, Inc., a common tactic to evade traditional takedown mechanisms. According to VirusTotal aggregation as of the latest scan, the site remains undetected with 14 out of 95 security engines flagging it. Historical WHOIS data (linked to seed 9c83ce) indicates recent creation, consistent with the rapid deployment of disposable phishing infrastructure. Google Safe Browsing (GSB) has not yet flagged this domain, and it currently appears on zero public blocklists. These technical indicators reflect an early-stage, low-profile campaign with minimal footprint, potentially indicating either a new or opportunistic threat actor leveraging automation or recycled infrastructure.

As of the latest analysis, ladgr-liv-sec-app.pages.dev remains active and continues to serve a spoofed Ledger Live login portal. While no payload delivery mechanism (e.g., drainer.js) has been confirmed, the site is capable of capturing submitted credentials and may exfiltrate them to an attacker-controlled server. Immediate mitigation includes blocking the domain at DNS and network levels, and users are advised to verify all wallet access points via official Ledger channels only. The remaining risk is classified as 'under_investigation' due to active monitoring for evolving payloads or additional infrastructure linkages. Security teams are urged to add this domain to threat intelligence feeds and monitor for associated IOCs, including IP 172.66.47.202 and SSL issuer 'Google Trust Services'.