lezgers-liives-loggif-ens[.]pages[.]dev

PhishDestroy identifies lezgers-liives-loggif-ens.pages.dev as an active brand impersonation phishing domain targeting Ledger users. The fraudulent page mimics the official Ledger Live login portal, complete with a spoofed title and SSL certificate issued by Google Trust Services. This campaign employs a drainer kit designed to steal cryptocurrency wallet credentials and assets, leveraging Cloudflare’s infrastructure to evade detection and prolong its operational lifespan. The domain was flagged under seed b22e9a and remains under active investigation as of the latest scan.

This domain resolves to IP 172.66.44.176, registered through Cloudflare, Inc. VirusTotal analysis shows 0 detections out of 95 scanners, indicating low detection coverage despite clear malicious intent. The domain was created recently, with no further creation date details available, and the Google Safe Browsing (GSB) status is unconfirmed. It has not yet been added to major blocklists, leaving potential victims exposed to ongoing attacks.

The domain is currently active and poses a high risk to Ledger users seeking legitimate wallet access. PhishDestroy recommends immediate domain blocking and user awareness campaigns to mitigate exposure. Remaining risk is classified as under investigation due to the absence of VirusTotal detections and blocklist inclusion. Users should verify URLs via official Ledger channels and avoid interacting with this or similar spoofed domains.