# lgin-cd-en-ledger-support.pages.dev — MALICIOUS

> ALERT: lgin-cd-en-ledger-support.pages.dev is a Ledger login credential phishing page flagged by 13/95 VirusTotal vendors. Check the full report.

## Summary
The domain lgin-cd-en-ledger-support.pages.dev is an active credential-harvesting page impersonating Ledger’s login interface, posing an elevated risk to cryptocurrency users seeking support.

This domain was flagged by PhishDestroy as a targeted brand impersonation phishing site with a confirmed risk level of elevated. Intelligence confirms it resolves to IP 172.66.44.187, is registered through Cloudflare, Inc., and has been detected by 13 out of 95 VirusTotal security vendors. The site leverages Cloudflare Pages to host a convincing replica of Ledger’s support login portal, aiming to steal user credentials and sensitive financial data.

Security analysts should treat this domain with high caution due to its active status and the specific credential theft objective. Due to its use of Cloudflare infrastructure, traditional IP-based blocking may be limited, so domain-level blocking or browser-based protections are recommended. Users are advised to verify all Ledger support links directly through official channels and enable multi-factor authentication on their accounts to mitigate potential compromise. Report any interactions with this domain to your security team or use URL filtering tools to block access entirely.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Ledger

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.187

## Detection Status
- VirusTotal: 13 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- PhishDestroy: https://phishdestroy.io/domain/lgin-cd-en-ledger-support.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/lgin-cd-en-ledger-support.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/lgin-cd-en-ledger-support.pages.dev/
Last updated: 2026-03-26