public-ledger-live[.]pages[.]dev

PhishDestroy identifies public-ledger-live.pages.dev as an active brand impersonation site targeting Ledger users. The domain masquerades as the official Ledger Live interface to deceive visitors into entering sensitive wallet credentials or downloading malicious software. No crypto drainer kit signatures were detected in the initial scan, but the page structure suggests a credential harvesting mechanism. The threat actor leverages Cloudflare’s infrastructure to obscure hosting details while using a Google Trust Services SSL certificate to appear legitimate. This setup is typical of phishing campaigns aiming to exploit brand recognition for financial gain.

Technical indicators reveal critical details: VirusTotal currently flags the domain with 9/95 detections, indicating it remains undetected by most antivirus engines. The domain is registered through Cloudflare, Inc., resolving to IP 188.114.96.3. Google Safe Browsing (GSB) has not yet classified this domain, and no third-party blocklists currently include it. The domain’s creation date is recent, aligning with the timeline of active impersonation campaigns targeting cryptocurrency users. These indicators suggest a newly deployed threat with evasion tactics to avoid early detection.

The domain remains active and under investigation as of the latest assessment. PhishDestroy advises immediate blacklisting of public-ledger-live.pages.dev and any associated IPs or domains. Users should avoid interacting with this site and report it to their security teams or browser vendors. While the risk is currently low due to low detection rates, the potential for credential theft or malware distribution remains high. Continuous monitoring is required until the domain is fully neutralized or added to global blocklists.