leedger-livee-cloud[.]pages[.]dev

PhishDestroy identifies a recently active phishing domain, leedger-livee-cloud.pages.dev, impersonating the legitimate Ledger Live cryptocurrency wallet interface. This fraudulent site attempts to trick users into entering their recovery phrases or private keys by mimicking the familiar login flow of the official Ledger application. Victims who input their credentials risk immediate theft of digital assets and potential compromise of associated accounts, making this a high-stakes threat in the crypto space.

This domain was flagged through automated monitoring and analysis. It resolves to IP address 172.66.47.50 and leverages a Google Trust Services SSL certificate to appear legitimate. Crucially, VirusTotal currently shows zero detections out of 95 scanning engines, indicating this threat has evaded broad signature-based detection systems. The page is hosted on Cloudflare Pages, a service often abused by threat actors for rapid deployment and evasion of takedown efforts. The infrastructure choices and lack of detections suggest this campaign is either newly launched or employing advanced obfuscation techniques.

If you have visited leedger-livee-cloud.pages.dev, cease all interaction immediately and take the following steps: Disconnect any affected devices from the internet to prevent further data exfiltration. Revoke any credentials entered on the site, including recovery phrases, wallet passwords, and associated email accounts. Scan your device for malware using reputable antivirus software, as phishing sites often deploy info-stealing trojans. Monitor your cryptocurrency wallets and financial accounts for unauthorized transactions. Report the domain to your wallet provider and consider filing an incident report with relevant cybercrime units. Always access Ledger services through the official ledger.com domain or verified application stores to avoid similar threats in the future.