ldgr-live--download[.]pages[.]dev

PhishDestroy classifies ldgr-live--download.pages.dev as an active crypto-draining phishing domain at elevated risk. This subdomain of pages.dev leverages Cloudflare infrastructure and Google-issued SSL certificates to mimic legitimate download portals, luring victims into connecting crypto wallets under the false promise of file access.

Technical indicators confirm the threat: VirusTotal shows just 1 out of 95 security vendors flagging the domain; it resolves to IP 188.114.97.3 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may lower user suspicion. While no blocklist entries were detected in open-source feeds, the minimal detection ratio underscores the stealthiness of this campaign—likely designed to evade automated scanning.

Mitigation starts with wallet isolation: never connect high-value accounts to unfamiliar sites. Users should also block the IP 188.114.97.3 at the firewall and report the domain to browser vendors and threat intel platforms. Enterprises should update proxy rules to deny traffic to *.pages.dev subdomains unless explicitly whitelisted, and consider DNS sinkholing for this IP to neutralize the payload delivery chain.