leadger-live-lo-eng[.]pages[.]dev

PhishDestroy identifies the domain leadger-live-lo-eng.pages.dev as an active cryptocurrency drainer impersonating Ledger Live, a legitimate hardware wallet service. This fraudulent page employs a spoofed login interface to harvest wallet credentials and seed phrases, typically redirecting victims to drain their crypto holdings. The infrastructure leverages Cloudflare Pages for hosting, enabling rapid deployment and evasion of traditional blocklists. Unique seed hashes and redirect chains observed in this campaign align with known crypto-draining toolkits, notably those targeting Ledger users through fake ‘update’ or ‘security’ portals. This domain was flagged by 4 out of 95 VirusTotal security vendors, indicating limited but notable detection coverage. It was registered through Cloudflare, Inc., resolving to IP address 172.66.44.71 with a Google Trust Services SSL certificate. While creation timestamps remain obscured by Cloudflare’s proxy, the certificate’s issuance date and domain age suggest recent deployment. The domain has not yet been flagged by Google Safe Browsing (GSB), and current blocklist inclusion stands at minimal levels—further illustrating the evasive nature of this campaign. As of this advisory, the domain remains active with an elevated risk profile. PhishDestroy recommends immediate network-level blocking of 172.66.44.71 and domain-level restrictions for leadger-live-lo-eng.pages.dev. Remaining risk persists due to the campaign’s use of legitimate cloud infrastructure and rapid domain rotation, necessitating continuous monitoring. Users should verify all Ledger Live access points via official sources and avoid unsolicited links claiming to require ‘updates’ or ‘security checks.’