l-live-us-ledg[.]pages[.]dev

PhishDestroy identifies l-live-us-ledg.pages.dev as a high-risk brand-impersonation phishing domain actively targeting Ledger cryptocurrency users by masquerading as the official Ledger Live crypto app. This attack aims to trick victims into downloading malicious software or surrendering sensitive wallet credentials under the guise of a legitimate software update or account verification. The domain is designed to exploit brand trust, redirecting to a counterfeit interface that closely mimics Ledger’s official branding, colors, and layout to maximize user deception and credential harvesting success. This domain was flagged by PhishDestroy using seed 4de5a3. Threat intelligence confirms it resolves to IP 172.66.47.151 and is served via Cloudflare, Inc. with a Google Trust Services SSL certificate. VirusTotal analysis shows only 2 out of 95 security vendors currently detect this threat, indicating low detection coverage despite clear malicious intent. The phishing page displays the title 'Ledger Live - Secure Crypto App,' directly copying Ledger’s official branding. Since its deployment, the domain remains active and continues to evade widespread blocklisting, posing an ongoing risk to uninformed users seeking legitimate Ledger services. Users who visited l-live-us-ledg.pages.dev should immediately cease any interaction, avoid entering any credentials or seed phrases, and scan their devices using trusted antivirus software. If any sensitive information was entered, revoke permissions and reset Ledger accounts through the official ledger.com domain. Report the domain to your security team or PhishDestroy for inclusion in threat databases. Always verify URLs using official Ledger domains and enable multi-factor authentication on all crypto-related accounts.