apps-live-ledge-x[.]pages[.]dev

PhishDestroy identifies apps-live-ledge-x.pages.dev as an active brand impersonation campaign targeting Ledger users. The domain mimics the official Ledger Live page title and hosts a crypto drainer designed to siphon digital assets under the guise of a legitimate service. This threat is still live and undetected by 13 out of 95 VirusTotal engines, indicating a low initial signature presence despite clear malicious intent.

This domain was flagged by PhishDestroy through automated correlation of page titles, SSL issuers, and brand abuse patterns. It resolves to IP 188.114.96.3 and is registered through Cloudflare, Inc., leveraging Google Trust Services for SSL certification. The page mimics Ledger Live’s branding with the title “Ledger Live® | Securing Your Digital Assets.” Key technical indicators include zero detections on VirusTotal despite active abuse, a Cloudflare front-end likely used to evade geoblocking or takedowns, and a recent Cloudflare Pages deployment structure typical of rapid campaign rotation. No known inclusion in blocklists as of time of writing.

Mitigation requires immediate user caution: never click links from unsolicited messages claiming to be from Ledger. Verify any domain, especially those using Cloudflare Pages or similar services, using PhishDestroy’s real-time scanner. Enable app-based verification for Ledger Live updates and only download software from the official ledger.com domain. If exposed, revoke any wallet permissions granted to connected apps, transfer funds to a cold wallet, and perform a full device reset. Report this domain via PhishDestroy to accelerate remediation and protect the broader community.