# guide-live-ledgir.pages.dev — SUSPICIOUS

> guide-live-ledgir.pages.dev is a fake Ledger crypto wallet site hosting phishing pages. This active domain (resolving to 172.66.47.

## Summary
PhishDestroy identifies guide-live-ledgir.pages.dev as an active phishing domain impersonating Ledger hardware wallet services to steal cryptocurrency credentials. This threat poses significant risk to users who may unknowingly enter sensitive wallet recovery phrases or login details on the fraudulent page. The domain leverages Cloudflare Pages hosting and Google Trust Services SSL certificate to appear legitimate, while resolving to IP 172.66.47.129.  

This domain was flagged with 0 detections out of 95 VirusTotal scans at the time of analysis, indicating it currently evades most automated detection systems. The domain is registered through Cloudflare, Inc. and uses Google Trust Services for SSL encryption, which contributes to its deceptive appearance. The active status suggests ongoing malicious operations, with the specific threat being credential harvesting for Ledger wallet accounts. The combination of trusted infrastructure and lack of detection makes this particularly dangerous for cryptocurrency users.  

Users should immediately cease any interaction with guide-live-ledgir.pages.dev and verify all Ledger-related URLs through official channels. Cryptocurrency holders should enable two-factor authentication on all wallet accounts and consider transferring assets to cold storage if any interaction occurred. Organizations should implement DNS filtering to block access to this domain and similar patterns. Report any suspicious activity to Ledger's official security channels and consider sharing indicators with threat intelligence platforms. This domain should be treated as high-risk despite current detection gaps, as the threat actor's infrastructure remains active and operational.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.129

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/926380f3-b828-484c-a889-83b15031e30c
- PhishDestroy: https://phishdestroy.io/domain/guide-live-ledgir.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/guide-live-ledgir.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/guide-live-ledgir.pages.dev/
Last updated: 2026-03-22