download-ledgerlive[.]pages[.]dev

PhishDestroy identifies the active domain download-ledgerlive.pages.dev as a Ledger brand impersonation used for distributing a fake Ledger Live software installer. The page mimics the legitimate Ledger ecosystem to trick users into downloading a crypto drainer disguised as an official application update. This threat leverages a spoofed installer to exfiltrate private keys and drain cryptocurrency wallets under the guise of a routine software update.

This domain resolves to IP address 172.66.47.84, registered through Cloudflare, Inc. PhishDestroy notes that the domain holds a legitimate SSL certificate issued by Google Trust Services, which may help it evade initial browser-based detections. VirusTotal currently shows 0/95 detection engines flagging the page, indicating it remains under the radar of many automated scanners. The domain was detected using seed 3a1ee0 and is currently unblocked by Google Safe Browsing (GSB). Further analysis reveals no known association with previously documented drainer toolkits, suggesting this may be a newly deployed campaign leveraging Cloudflare Pages for rapid deployment and evasion.

As of this report, the threat remains active and under investigation by PhishDestroy’s threat intelligence team. Immediate response actions include domain takedown requests to Cloudflare and coordination with Ledger’s security team. However, due to the use of legitimate hosting infrastructure and SSL certificates, the risk of continued evasion persists. Users are strongly advised to verify any download links or software sources directly through Ledger’s official website (ledger.com) and to use PhishDestroy’s real-time verification tools before engaging with any suspicious domains. The remaining risk is assessed as high given the current lack of detection coverage and the domain’s active status.