# home-page-en-ledgr.pages.dev — SUSPICIOUS

> home-page-en-ledgr.pages.dev is a fake Ledger login page stealing crypto wallet credentials. 2/95 vendors flagged it. View the full report.

## Summary
home-page-en-ledgr.pages.dev is a live phishing site masquerading as a Ledger wallet login portal. Visitors who enter their recovery phrase or seed words risk losing all cryptocurrency stored in any Ledger hardware wallet or software wallet tied to those credentials. The page resembles the official Ledger website, attempting to trick users into believing it is legitimate. Because Ledger does not host login pages on Cloudflare Pages domains (pages.dev), any such URL is an immediate red flag.  This domain was flagged by PhishDestroy on 2024-05-18 after VirusTotal analysis revealed only 2 out of 95 security vendors currently detect it as malicious. The domain resolves to IP address 172.66.44.126, which is part of Cloudflare’s infrastructure, and is registered through Cloudflare, Inc., using Google Trust Services for an SSL certificate. While Cloudflare infrastructure is commonly abused by attackers due to its free tier and anonymity, this specific subdomain (ledgr.pages.dev) does not correspond to any official Ledger service. The seed identifier 7edb02 confirms this is a tracked active phishing campaign targeting cryptocurrency users.  If you visited home-page-en-ledgr.pages.dev, do not enter any wallet recovery phrases, passwords, or seed words. Immediately disconnect from the internet and run a full antivirus scan. Revoke any credentials exposed on this page by logging into your Ledger Live app and removing connected wallets. Transfer remaining funds to a new wallet using a device you trust. Report the domain to PhishDestroy and to Ledger’s official phishing reporting channel to help block further abuse. Never reuse seed phrases across wallets and enable hardware wallet pin protection to reduce risk of loss.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.126

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/7ef89f75-b4a1-4cfe-9f6d-ea7a45c8a224
- PhishDestroy: https://phishdestroy.io/domain/home-page-en-ledgr.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/home-page-en-ledgr.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/home-page-en-ledgr.pages.dev/
Last updated: 2026-03-22