leddger-llives[.]pages[.]dev

PhishDestroy identifies leddger-llives.pages.dev as an active brand impersonation phishing site targeting Ledger users. This domain is configured to deceive visitors into connecting crypto wallets under the guise of a legitimate Ledger portal, likely executing a drainer kit upon wallet interaction. The page leverages Cloudflare’s Workers platform to host a spoofed interface, aiming to harvest seed phrases or authorize malicious transactions without raising immediate suspicion. Security telemetry indicates this threat is operational and designed for quick credential or fund exfiltration. This domain resolves to IP 172.66.44.79 and is registered through Cloudflare, Inc. It carries a VirusTotal detection score of 1/95 security vendors as of the latest scan, indicating low but present detection due to behavioral anomalies. The SSL certificate is issued by Google Trust Services, which may lend superficial legitimacy. Notably, this domain was created recently and has not yet accumulated significant blocklist presence, suggesting it is part of a fast-moving campaign. Its use of a .pages.dev subdomain under Cloudflare’s Pages service enables rapid deployment and evasion of traditional hosting-based takedowns. As of current monitoring, leddger-llives.pages.dev remains active with an elevated risk profile. PhishDestroy has flagged this domain and assigned a unique seed identifier (00cdc8) for tracking across threat intelligence networks. Immediate remediation includes network-level blocking via DNS or firewall rules targeting the IP and domain. Users should avoid interacting with this page and verify any Ledger-related URLs using PhishDestroy’s validation tool. While the domain shows limited detection coverage, its behavioral intent and targeting of a high-value brand elevate the risk of successful compromise. Continuous monitoring is advised as this campaign may evolve or spawn related domains.