walt-live-ledgr-info-use[.]pages[.]dev

PhishDestroy identifies walt-live-ledgr-info-use.pages.dev as an active generic phishing domain impersonating Ledger Live crypto wallet support pages. The domain leverages Cloudflare’s infrastructure and a Google Trust Services SSL certificate to appear legitimate, suggesting a drainer kit designed to harvest user credentials or seed phrases under the guise of technical support or firmware updates. This type of attack typically targets cryptocurrency users by presenting fake “live” status pages or support portals that mimic official Ledger domains, aiming to trick victims into disclosing sensitive information during urgent-sounding prompts. This domain resolves to IP address 172.66.47.27 and is registered through Cloudflare, Inc. VirusTotal currently shows 11 out of 95 antivirus engines detecting the domain, indicating it remains under the radar of most automated scanning tools. The domain uses a valid SSL certificate issued by Google Trust Services, which enhances its credibility and reduces immediate suspicion from users. At this stage, the domain has not been widely blocklisted, and its creation date is recent, with no long-term reputation to flag it as malicious. These factors suggest a newly deployed campaign with high potential for evasion and increased reach among unsuspecting victims. As of this report, the domain remains active and under investigation, with no immediate takedown action confirmed. Cloudflare has not yet suspended the domain, and Google Safe Browsing (GSB) has not flagged it—likely due to low detection rates and the use of legitimate infrastructure. Users should avoid accessing this domain and report it immediately to their security teams or browser vendors. The risk remains high until blocklists are updated and automated detection improves. PhishDestroy advises blocking 172.66.47.27 at the network level and monitoring for similar domains leveraging Cloudflare Workers or Pages to host phishing content.