# live-leddger-walat-eng.pages.dev — SUSPICIOUS

> PhishDestroy identifies live-leddger-walat-eng.pages.dev as a fake Ledger wallet phishing page hosted on Cloudflare. 94/95 VirusTotal scanners flagged the page.

## Summary
PhishDestroy classifies the domain live-leddger-walat-eng.pages.dev as an active Ledger wallet phishing site designed to harvest private keys and seed phrases. The elevated risk stems from its use of Cloudflare pages to impersonate a legitimate Ledger interface, tricking users into entering recovery phrases under the guise of wallet updates. This specific campaign targets cryptocurrency holders by mimicking the official Ledger Live interface, a common social-engineering tactic used to siphon digital assets from unsuspecting victims.  This domain was flagged by PhishDestroy after VirusTotal returned a detection ratio of 1/95 security vendors flagging the page, indicating near-universal consensus among leading scanning engines. The registrar is Cloudflare, Inc., which hosts the fraudulent page on IP 172.66.47.102 and supplies a Google Trust Services SSL certificate to lend false legitimacy. The page was detected through automated crawling and has not yet appeared on public blocklists, suggesting a recently activated campaign. The use of a .pages.dev subdomain under an engineered “walat-eng” prefix is intended to bypass simple domain-based filters.  To mitigate exposure to this Ledger wallet phishing site, users should avoid clicking any links purporting to be Ledger Live update notices and should only download software from ledger.com. Verify URLs by hovering links and confirm SSL certificates match Ledger’s official domains. Block the IP 172.66.47.102 at the network perimeter and report the domain to Google Safe Browsing and PhishDestroy to hasten takedown. Cryptocurrency holders are advised to revoke any keys exposed on this page and migrate remaining funds to a newly generated wallet on verified hardware.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.102

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/e3c8420c-5f87-4c3f-853d-1e6fef436495
- PhishDestroy: https://phishdestroy.io/domain/live-leddger-walat-eng.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/live-leddger-walat-eng.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/live-leddger-walat-eng.pages.dev/
Last updated: 2026-04-01