# cloud-ledgr-ang.pages.dev — SUSPICIOUS

> cloud-ledgr-ang.pages.dev is a fake Ledger login page stealing crypto via a crypto drainer, detected only 0/95 times on VirusTotal.

## Summary
PhishDestroy identifies cloud-ledgr-ang.pages.dev as a live phishing site impersonating Ledger’s official login portal, designed to trick users into entering their recovery phrases or private keys. This domain leverages Cloudflare Pages hosting and a Google Trust Services SSL certificate to appear legitimate, while resolving to IP address 172.66.47.190. The page is currently undetected by 95 VirusTotal scanners, indicating it has flown under the radar despite its active campaign. This tactic is common among crypto drainers, which harvest credentials to drain victim wallets within minutes of submission.  This domain was flagged under investigation after confirming zero detections on VirusTotal despite clear phishing indicators, including the deliberate misspelling of “Ledger” as “Ledgr” in the subdomain. The site was registered through Cloudflare, Inc., a common choice for threat actors seeking anonymity and rapid deployment. The use of a Google-issued SSL certificate adds a false sense of security, as many users trust HTTPS as a sign of legitimacy. Technical analysis shows the domain resolves to a Cloudflare IP in San Francisco, a known hosting region for malicious infrastructure.  If you visited cloud-ledgr-ang.pages.dev or entered any information, immediately revoke access to all connected wallets using your Ledger device’s manager app. Transfer remaining assets to a newly generated wallet not exposed to the compromised session. Scan your device for malware using Ledger’s official recovery tool and change all passwords associated with crypto accounts. Report the domain to PhishDestroy and Ledger’s support team using the official phishing report form. Never trust links in emails or messages—always navigate to Ledger.com manually and verify any page URL begins with https://www.ledger.com/ before entering sensitive data.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.190

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/26fe8ea5-5f48-422e-a3c5-292509294800
- PhishDestroy: https://phishdestroy.io/domain/cloud-ledgr-ang.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/cloud-ledgr-ang.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/cloud-ledgr-ang.pages.dev/
Last updated: 2026-03-24