ladger-live-logins[.]pages[.]dev

PhishDestroy identifies ladger-live-logins.pages.dev as an active credential phishing site impersonating Ledger Live to harvest cryptocurrency wallet credentials. The domain leverages a fake login page designed to drain assets from unsuspecting users by capturing seed phrases or private keys entered into the fraudulent interface. Behavioral analysis indicates automated form submission and data exfiltration to an external command-and-control server, consistent with known crypto drainer toolkits. This domain resolves to IP 172.66.47.111 via Cloudflare, Inc. and is served over HTTPS with a Google Trust Services SSL certificate. VirusTotal analysis shows 5 out of 95 security vendors flagged the domain as malicious as of the latest scan. The phishing page has propagated across multiple blocklists, and while not present in Google Safe Browsing (GSB) at time of analysis, its recent activation and low VT coverage suggest emergent threat status. WHOIS data indicates recent domain registration, consistent with fast-flux tactics used to evade detection and mitigation. PhishDestroy currently lists ladger-live-logins.pages.dev as ACTIVE with elevated risk. Immediate response actions include domain takedown requests to Cloudflare and registrar, IP de-listing, and browser-based blocking via PhishDestroy’s real-time threat feed. Residual risk remains moderate due to the domain’s use of legitimate infrastructure (Cloudflare, Google SSL) and potential for rapid propagation. Users are strongly advised to avoid this domain, verify all crypto login URLs manually, and rely on PhishDestroy’s verified blocklists for safe browsing.