ldger--live[.]pages[.]dev

PhishDestroy identifies ldger--live.pages.dev as an active Ledger brand impersonation phishing domain operating at elevated risk. The page is hosted on Cloudflare Pages under a deceptive subdomain pattern designed to trick visitors into disclosing sensitive wallet credentials or seed phrases. Threat actors commonly leverage typosquatting and brand spoofing to harvest cryptocurrency assets, making this domain particularly dangerous for users seeking Ledger support or purchasing hardware wallets.

This domain was flagged by PhishDestroy with the following confirmed indicators: VirusTotal detection ratio of 2 out of 95 security vendors, registration through Cloudflare, Inc., network resolution to IP 172.66.47.133, and active impersonation of the Ledger brand. The use of Cloudflare Pages enables rapid deployment and evasion of traditional takedown efforts through Cloudflare’s rotating IP infrastructure and CDN obfuscation. The subdomain format ldger--live.pages.dev employs a double-hyphen pattern mimicking legitimate Ledger Live domains, increasing the likelihood of user deception.

To mitigate exposure to this threat, users must avoid clicking links in unsolicited emails or social media messages claiming to be from Ledger. Always access official Ledger services via verified bookmarks or direct navigation to ledger.com. Enable multi-factor authentication on all crypto accounts and never enter seed phrases or private keys into web forms. Report suspected phishing domains like ldger--live.pages.dev to PhishDestroy and relevant blocklists to disrupt ongoing campaigns. Network administrators should block the IP 172.66.47.133 and monitor for related subdomains using the seed 3a21d2 for pattern matching.