action-livlog-en-us[.]pages[.]dev

PhishDestroy identifies action-livlog-en-us.pages.dev as a confirmed brand impersonation site actively masquerading as Ledger, a leading cryptocurrency hardware wallet provider. The domain is currently live and employs deceptive tactics to trick users into entering sensitive credentials under the guise of Ledger Live Login services. This constitutes a direct attempt at credential theft targeting cryptocurrency users.

This domain was flagged by 13 of 95 VirusTotal security vendors despite clear indicators of malicious intent. It operates under Cloudflare, Inc. hosting and resolves to IP 188.114.97.3. The SSL certificate is issued by Google Trust Services, which may provide a false sense of legitimacy. The site currently remains unblocked and active in the threat landscape.

Given the high-risk nature of this brand impersonation targeting Ledger users, PhishDestroy strongly recommends immediate avoidance and blocking of this domain. Users who may have interacted with this site should revoke any entered credentials, enable two-factor authentication on their Ledger accounts, and report the incident. Organizations are advised to add this domain and IP to network blocklists. Continuous monitoring is essential as this domain may evolve to incorporate additional malicious payloads such as crypto drainers.