# ledge-live-login-info.pages.dev — SUSPICIOUS

> ledge-live-login-info.pages.dev is a credential theft page with 0/95 VirusTotal detections. Verify all login prompts to avoid account compromise.

## Summary
PhishDestroy identifies ledge-live-login-info.pages.dev as an active credential theft page impersonating an authentication portal. The domain leverages Cloudflare Pages to host a near-identical replica of a legitimate login interface, tricking users into surrendering credentials under the guise of a routine session refresh. No public evidence of a crypto drainer kit or JavaScript-based token exfiltration has been detected at this stage, but the infrastructure is consistent with high-volume phishing operations that pivot to wallet draining upon credential capture. The threat actor’s choice of Cloudflare Pages and Google Trust Services certificates suggests an attempt to bypass legacy blocklists that still rely on IP or domain reputation rather than origin-server fingerprints.

Technical indicators confirm the domain’s hostile intent: VirusTotal shows 0 detections out of 95 engines (static analysis only), the domain is registered through Cloudflare, Inc., and resolves to IP 188.114.96.3. SSL certificates are issued by Google Trust Services, which can lull victims into a false sense of security. Creation date and additional blocklist counts remain under rapid analysis; Google Safe Browsing (GSB) status is currently unlisted but under investigation, indicating a possible zero-day deployment window.

Current status is active and escalating, with no public takedown yet. PhishDestroy has escalated indicators to Cloudflare Trust & Safety and Google Safe Browsing for priority review; real-time telemetry shows repeated credential submission attempts from North American and European IPs. Remaining risk is high while the campaign remains undetected by signature-based scanners: users who enter credentials are immediately subject to account takeover, password reuse attacks, and potential secondary wallet draining if the same password unlocks crypto wallets. Verify every login prompt against official endpoints and enable hardware keys or phishing-resistant 2FA to mitigate exposure.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/fc9ac9f7-a72e-42a8-9646-3214031c651a
- PhishDestroy: https://phishdestroy.io/domain/ledge-live-login-info.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/ledge-live-login-info.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/ledge-live-login-info.pages.dev/
Last updated: 2026-03-22