le-igerd-live-learn[.]pages[.]dev

PhishDestroy identifies the domain le-igerd-live-learn.pages.dev as an active Ledger brand impersonation scam designed to deceive cryptocurrency users into surrendering sensitive credentials. The threat actor leverages Cloudflare Pages to host a spoofed interface mimicking Ledger’s official website, exploiting trust in the brand to trick victims into entering recovery phrases or API keys. This domain resolves to IP 188.114.96.3 and uses a Google Trust Services SSL certificate to appear legitimate, further lowering user suspicion. The campaign is currently under investigation but remains actively accessible, posing a direct risk to cryptocurrency holders. This domain was flagged with 0 detections out of 95 engines on VirusTotal, indicating it has evaded automated detection despite clear malicious intent. It was registered through Cloudflare, Inc., a common tactic to obscure true ownership and avoid takedowns. While the exact creation date is not provided, the use of Cloudflare Pages suggests recent deployment, likely within days or weeks. The domain’s infrastructure aligns with known phishing operations targeting Ledger users, who are often targeted due to the prevalence of recovery phrase theft in cryptocurrency fraud. Given the zero detections on VirusTotal, traditional security tools may fail to block this threat, increasing reliance on manual user vigilance. Users who visited this domain should immediately check their browser history and bookmarks for any accidental access to le-igerd-live-learn.pages.dev. If credentials were entered, revoke all associated API keys and recovery phrases immediately, as they may have been compromised. Use Ledger’s official recovery tool or support channels to verify account safety. Clear cookies and cached data from browsers to prevent session hijacking, and consider enabling two-factor authentication on all cryptocurrency-related accounts. Report the domain to Ledger’s fraud team and submit it to PhishDestroy’s database for further analysis to protect other users.