# lleedger-live.pages.dev — SUSPICIOUS

> lleedger-live.pages.dev impersonates Ledger Live crypto wallet with 0/95 VirusTotal detections. Check the full report.

## Summary
PhishDestroy identifies lleedger-live.pages.dev as a counterfeit Ledger Live cryptocurrency wallet phishing page actively hosted on Cloudflare Workers, with SSL issued by Google Trust Services and resolving to 172.66.47.71. This domain employs a visually deceptive replica of the official Ledger Live interface to trick users into entering seed phrases, private keys, or login credentials, enabling cryptocurrency theft. The threat actor leverages Cloudflare’s infrastructure to obscure hosting origins and bypass traditional network-level blocking, posing significant risk to cryptocurrency holders seeking secure access to their digital assets.


This domain was flagged after analysis revealed zero detections out of 95 engines on VirusTotal as of the latest scan, indicating it currently evades most signature-based detection systems. It is registered through Cloudflare, Inc. and resolves to IP 172.66.47.71. While specific registrar data and domain age were not disclosed, the use of pages.dev subdomain under Cloudflare Workers suggests recent deployment designed for agility and evasion. The low detection rate, paired with legitimate SSL issuance, increases the likelihood of successful user compromise, especially when accessed via phishing emails or fake wallet update prompts.


If you have visited lleedger-live.pages.dev, immediately cease entering any credentials or cryptocurrency-related information. Disconnect from the network, clear browser cache and cookies, and consider revoking any wallet access grants or changing passwords if exposed. Scan your devices with updated antivirus software and verify wallet access only through bookmarked, official domains (e.g., ledger.com/live). Report any suspicious transactions to your wallet provider and monitor associated crypto addresses for unauthorized transfers. Never use links from unsolicited messages to access financial portals.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.71

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/c2b8a810-f0a3-4fb2-a64a-a6f5a5677d47
- PhishDestroy: https://phishdestroy.io/domain/lleedger-live.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/lleedger-live.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/lleedger-live.pages.dev/
Last updated: 2026-03-23