login-ledgerlive-sso[.]pages[.]dev

PhishDestroy identifies login-ledgerlive-sso.pages.dev as an active brand impersonation phishing domain targeting Ledger cryptocurrency wallet users by mimicking official login pages. This malicious domain employs deceptive tactics to trick visitors into entering sensitive credentials, putting crypto assets at risk. The impersonation leverages visual and textual cues to appear legitimate, exploiting trust in Ledger’s brand reputation. This threat was flagged with 0 VirusTotal detections out of 95 scans, indicating a currently undetected payload. Registered through Cloudflare, Inc., the domain was created via Google’s Pages service and resolves to IP address 172.66.46.221 under a Google Trust Services SSL certificate, adding superficial credibility. PhishDestroy’s seed analysis (725f21) confirms this as a fresh, actively monitored threat vector within the Ledger ecosystem. If you visited login-ledgerlive-soo.pages.dev, immediately inspect your browser history and Ledger account for unauthorized access. Do not enter any cryptocurrency wallet recovery phrases or sensitive data on this or similar domains. Report the incident to Ledger’s official support and run a malware scan. Disable any saved browser passwords for this domain and enable two-factor authentication on all crypto accounts. Stay vigilant against brand impersonation tactics targeting financial services.