ledgers-livoxx-eng[.]pages[.]dev

PhishDestroy identifies ledgers-livoxx-eng.pages.dev as an active crypto drainer domain impersonating Ledger Live services to steal cryptocurrency. This page.dev subdomain is being actively used to deploy malicious JavaScript designed to drain wallet funds upon connection. The threat is particularly dangerous as it masquerades as a legitimate Ledger integration, exploiting user trust in hardware wallet ecosystems. Technical indicators reveal this domain operates through Cloudflare's Pages service, resolving to IP 172.66.47.87 with a Google Trust Services SSL certificate, evading immediate detection while maintaining operational legitimacy through established infrastructure providers.

This domain was flagged with 0 detections out of 95 VirusTotal scans, was registered via Cloudflare, Inc., and remains unblocked at the time of analysis. The unique seed 5f8084 indicates this is part of an evolving campaign targeting cryptocurrency users. The absence of antivirus detection combined with trusted infrastructure highlights the sophisticated nature of this threat, which specifically targets users expecting safe Ledger Live integrations. The campaign's infrastructure choices suggest deliberate attempts to bypass initial security screening while maintaining persistent access to stolen funds.

Users who visited ledgers-livoxx-eng.pages.dev should immediately disconnect any connected wallets and transfer remaining funds to a newly created wallet. Scan all devices that accessed this domain using reputable antivirus software, particularly focusing on browser extensions that may have been compromised. Report any unauthorized transactions to your wallet provider and consider revoking any suspicious smart contract approvals. This threat demonstrates the ongoing evolution of cryptocurrency-focused malware, where attackers continuously adapt delivery methods to exploit user trust in legitimate services.