access-ledzerlive-walet-cdn[.]pages[.]dev

PhishDestroy identifies access-ledzerlive-walet-cdn.pages.dev as a generic phishing domain deployed under Cloudflare Pages, configured as a crypto drainer kit impersonating the Ledger crypto wallet ecosystem. The page leverages a fake 'wallet access' interface to trick users into connecting malicious wallets or revealing seed phrases. Threat analysis suggests this is part of an automated phishing-as-a-service campaign targeting cryptocurrency users through deceptive CDN-hosted pages disguised as legitimate wallet services.

This domain resolves to IP 172.66.44.183 and is registered via Cloudflare, Inc., using a Google Trust Services SSL certificate to enhance credibility. As of current telemetry, VirusTotal shows 0 detections out of 95 engines, indicating this threat remains largely undetected in public scanning tools. The domain was created recently and is hosted on Cloudflare Pages, a platform often abused for short-lived phishing campaigns due to its free tier and fast deployment. While no confirmed blocklist entries exist yet, the absence of detections highlights the stealth and agility of this campaign.

The threat is currently active and under investigation by PhishDestroy, with no official blocklist inclusion confirmed. Users are advised to avoid interacting with this domain and verify any wallet access page using PhishDestroy’s real-time domain checker. Remaining risk is assessed as HIGH due to the domain’s live status, lack of detection coverage, and the potential for immediate fund loss if credentials or seed phrases are entered. Response actions include ongoing monitoring, IP/domain takedown requests to Cloudflare, and user awareness dissemination to prevent crypto asset theft.