ledger-livelogin--us[.]pages[.]dev

PhishDestroy identifies ledger-livelogin--us.pages.dev as an active brand impersonation domain targeting Ledger users with a fraudulent login portal designed to drain cryptocurrency wallets. This domain employs deceptive branding to trick victims into entering recovery phrases or private keys, enabling attackers to siphon funds directly from connected wallets. The threat level is elevated due to the combination of impersonation tactics and the presence of confirmed malicious indicators, including a high-risk detection rate from multiple security vendors. This domain was flagged with a VirusTotal detection score of 10 out of 95 security vendors, indicating significant suspicion. The domain resolves to IP address 172.66.44.57 and is registered through Cloudflare, Inc., leveraging Google Trust Services for its SSL certificate. While the exact creation date is not publicly disclosed, the domain’s association with Cloudflare’s Pages.dev infrastructure suggests recent deployment aimed at evading traditional blocklists. The presence of 10/95 detections on VirusTotal, combined with the impersonation of a high-value brand like Ledger, places this domain at elevated risk for cryptocurrency theft. Mitigation for this threat requires immediate action. Users must avoid interacting with ledger-livelogin--us.pages.dev or any similar domains claiming to offer Ledger Live login services. Always verify URLs by typing them manually or using PhishDestroy’s verification tools to confirm legitimacy. Enable multi-factor authentication on Ledger accounts and use hardware wallets for all transactions. Report suspicious domains to Ledger’s official support channels and consider blocking the IP address 172.66.44.57 at the network level if possible. Stay vigilant for phishing attempts via email, SMS, or social media, as these are common vectors for redirecting users to fraudulent sites.