ledgerliev--app[.]pages[.]dev

PhishDestroy identifies ledgerliev--app.pages.dev as an active Ledger brand impersonation domain under investigation for phishing threats. This domain, resolved via Cloudflare’s infrastructure to IP 172.66.44.101, hosts a fraudulent replica designed to deceive users into disclosing sensitive Ledger account details or payment information. The phishing page leverages the legitimate Google Trust Services SSL certificate to appear trustworthy, creating a false sense of security for potential victims. Such tactics are common in credential harvesting and financial fraud campaigns targeting cryptocurrency users.

Evidence from multiple security platforms confirms this domain’s malicious intent. VirusTotal currently reports 10 out of 95 detection engines flagging the domain, highlighting its stealthy nature and the challenge of early detection. The domain is registered through Cloudflare, Inc., a common choice among threat actors seeking anonymity and fast propagation. While the creation date is not provided, the use of Google Trust Services' SSL certificate suggests recent deployment aimed at capitalizing on Ledger users' trust. The absence of VirusTotal detections underscores the need for proactive threat hunting and user vigilance.

If you accessed ledgerliev--app.pages.dev or entered any information, stop using the site immediately and change your Ledger account password via the official Ledger website. Enable two-factor authentication if not already active and monitor your accounts for unauthorized transactions. Report any suspicious activity to Ledger’s official support channels and submit the domain to PhishDestroy’s database for further analysis. Do not download or install any software or files from this domain. Always verify URLs by checking for exact spelling and the presence of HTTPS on legitimate Ledger domains (ledger.com).