ledgre-live-uss[.]pages[.]dev

PhishDestroy identifies ledgre-live-uss.pages.dev as an active brand impersonation domain targeting Ledger users, currently under investigation for potential crypto drainer activity.

This domain was flagged after exhibiting clear indicators of malicious intent. The site leverages a Google Trust Services SSL certificate while impersonating Ledger’s official branding. Registered through Cloudflare, Inc., it resolves to IP 172.66.45.36 and remains undetected on VirusTotal with 11/95 security vendor flags. Cloudflare’s Pages.dev platform is being exploited for this campaign, a method increasingly favored by threat actors to host short-lived malicious pages.

Given the absence of detection despite the domain’s suspicious characteristics, users should treat this domain with extreme caution. Ledger-related communications should only be trusted when verified through official channels. Immediate mitigation includes blocking the domain at DNS and firewall levels, and reporting the indicator to threat intelligence platforms. Users who may have interacted with this domain should revoke any connected wallet permissions and monitor for unauthorized transactions. Proactive verification through PhishDestroy is strongly recommended for any Ledger-branded communications.