eng-ledger-livedownload[.]pages[.]dev

PhishDestroy identifies eng-ledger-livedownload.pages.dev as an active brand impersonation phishing domain targeting Ledger cryptocurrency users. This domain employs a deceptive page title, 'Ledger Live Download — Secure Crypto Management,' to mimic the official Ledger Live software download portal. The threat actor leverages Cloudflare Pages for hosting and uses a Google Trust Services SSL certificate to enhance credibility. At this stage, no drainer kit artifacts have been extracted from the page, but the domain’s configuration suggests an imminent malware dropper or credential harvesting toolkit. eng-ledger-livedownload.pages.dev exhibits the following technical indicators: VirusTotal detection score of 10/95 as of latest scan, registered via Cloudflare, Inc., resolving to IP 172.66.47.41. The domain’s creation date remains unverified due to Cloudflare’s privacy protection, but it remains active and unlisted by Google Safe Browsing (GSB 0). Independent threat intelligence platforms have not yet flagged this domain, resulting in zero blocklist inclusions. The lack of detections underscores the evasive nature of this campaign, relying on fresh infrastructure and superficial legitimacy to deceive users. This domain remains active and continues to serve deceptive content. Immediate mitigation includes blocking the domain at network and DNS levels, updating browser and endpoint security policies to flag false positives using behavioral analysis, and user education to recognize mismatched branding cues. The residual risk remains high due to low detection coverage and the targeting of cryptocurrency users, who are often less cautious about verifying download sources. Users must treat this domain as hostile and abstain from interaction. Security teams are advised to monitor for derivative domains and IP associations to prevent downstream compromise.