app-login-ledgrlive[.]pages[.]dev

PhishDestroy identifies app-login-ledgrlive.pages.dev as an active credential-phishing domain that imitates the official Ledger Live login portal to steal cryptocurrency wallet credentials. This site was created to trick users into entering their recovery phrases or wallet passwords under the guise of a routine login, then immediately drain connected crypto assets. Phishing pages like this often propagate through fake emails, SMS, or social-media messages that appear legitimate but redirect victims to a spoofed domain hosted on Cloudflare Pages to evade traditional detection. The moment a user submits their credentials, the attackers transmit them via a crypto-drainer script and lock the victim out of their own wallet. Users have absolutely no time to react, so every second counts.

This domain was flagged by PhishDestroy analysts after VirusTotal returned 11 security-vendor detections out of 95 scans, indicating elevated maliciousness. The page is hosted behind the Cloudflare Pages service at IP address 172.66.44.97 and secured by a Google Trust Services SSL certificate—a common tactic cloudflare-deployed phishing domains use to appear trustworthy. Registrar data shows the site was newly minted within the past 48 hours, consistent with the rapid lifecycle of today’s credential-phishing campaigns. Cloudflare’s infrastructure and Google’s certificate authority do not inherently guarantee safety; they merely obscure the malicious origin from casual inspection.

If you visited app-login-ledgrlive.pages.dev, immediately disconnect any wallet apps and revoke any browser permissions you may have granted. Change passwords only on the official Ledger Live website, never from a link you clicked or a page you landed on unexpectedly. Run a reputable antivirus scan and consider a factory reset if you entered any sensitive data. Report the domain to PhishDestroy so our crawlers can block it for the wider community and help prevent others from becoming victims.