# ledger-login-helpweb.pages.dev — MALICIOUS

> ledger-login-helpweb.pages.dev was a high-risk Ledger phishing site now offline. Learn why it was flagged and how to stay protected.

## Summary
PhishDestroy identifies ledger-login-helpweb.pages.dev as a high-risk brand impersonation threat targeting Ledger users. This domain aimed to deceive victims by mimicking Ledger’s login process, putting sensitive credentials at risk.

The domain was created recently on February 21, 2026, and resolved to IP 172.66.47.90, registered through Cloudflare, Inc. It was flagged by 14 out of 95 VirusTotal security vendors and appeared on one security blocklist. Cloudflare hosted a warning page titled "Suspected phishing site," reflecting its malicious purpose. These factors confirm the domain’s intent and capability to facilitate phishing attacks.

Currently, the domain is taken offline, effectively neutralizing its threat. Users should remain vigilant against similar brand impersonation attempts by always verifying URLs and avoiding unsolicited login prompts. PhishDestroy recommends reporting suspicious Ledger-related domains and using official Ledger channels to ensure account safety.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Ledger
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.90
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["lee.ns.cloudflare.com", "walk.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "Criminal IP", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019a8fbe-6750-73fd-a859-e005fa8ee7f5.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/4fd31ca3-0ff8-4901-aa34-2af4ac3a0ef6
- PhishDestroy: https://phishdestroy.io/domain/ledger-login-helpweb.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/ledger-login-helpweb.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/ledger-login-helpweb.pages.dev/
Last updated: 2026-03-19