en-liveledgr-apps[.]pages[.]dev

en-liveledgr-apps.pages.dev has been flagged for hosting a fake Ledger Live application designed as a cryptocurrency drainer. The domain leverages deceptive branding to trick users into connecting their wallets or entering seed phrases, enabling unauthorized fund transfers. This threat is classified as a high-risk crypto drainer due to its active impersonation of a legitimate hardware wallet ecosystem service. Security researchers observed this domain as part of a broader campaign targeting cryptocurrency users through fake mobile or desktop app interfaces. The domain’s rapid deployment and use of trusted infrastructure suggest an evolving evasion strategy aimed at bypassing traditional detection mechanisms.

PhishDestroy identifies en-liveledgr-apps.pages.dev as a newly active crypto drainer with zero detections on VirusTotal out of 95 engines, indicating an early-stage threat not yet widely recognized. This domain resolves to IP address 172.66.44.227 via Cloudflare, Inc., which obscures the true origin while providing the attacker with high uptime and SSL encryption through Google Trust Services. The domain is hosted on Cloudflare Pages, a legitimate platform leveraged here for malicious intent due to its fast global distribution and free SSL certificates. With no current blocklist presence or community reports at the time of investigation, the threat remains undetected by major threat intelligence feeds. The use of a .pages.dev subdomain under Cloudflare’s free hosting service further lowers the barrier to deployment, allowing threat actors to rapidly cycle domains and infrastructure.

To mitigate risk, users should avoid interacting with en-liveledgr-apps.pages.dev or any site prompting wallet connections or seed phrase entry outside official Ledger applications. Verify download sources exclusively through Ledger’s official website (ledger.com) or verified app stores. Use hardware wallets with secure screens, enable PIN protection, and verify transaction details before approval. Report suspected phishing to Ledger’s official support and PhishDestroy. Security teams should monitor for similar domains mimicking Ledger Live, especially on Cloudflare Pages or Google App Engine, and proactively block IP 172.66.44.227 and associated ASN ranges. Always use multi-signature wallets, limit exposed wallet balances, and enable transaction alerts to detect unauthorized activity promptly.