# sso-ledger-live.pages.dev — MALICIOUS

> sso-ledger-live.pages.dev is a Ledger impersonation site detected by 8/95 VirusTotal scanners as a crypto drainer.

## Summary
PhishDestroy identifies sso-ledger-live.pages.dev as an active crypto drainer masquerading as a Ledger login portal, hosting a fraudulent Single Sign-On (SSO) interface designed to trick users into surrendering their recovery phrases or private keys.

This domain was flagged by 8 out of 95 VirusTotal security vendors and resolves to IP address 188.114.96.3. It is registered through Cloudflare, Inc., leveraging Google Trust Services for an SSL certificate to appear legitimate. The site mimics the branding and language of Ledger’s official platform, likely targeting users searching for “Ledger Live SSO” or similar terms, especially those managing cryptocurrency assets offline.

If you visited sso-ledger-live.pages.dev, do not enter any recovery phrases, seed phrases, or private keys. Disconnect your device from the internet immediately. Scan your system using up-to-date antivirus software and revoke any permissions or API keys granted to unknown or suspicious applications. If you entered sensitive information, move your crypto assets to a new wallet with a different seed phrase and report the incident to Ledger Support. Always access Ledger services via the official website ledger.com or verified download links.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Ledger

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 8 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/a82e8a6c-c1d1-4817-8956-cd2597b38b7c
- PhishDestroy: https://phishdestroy.io/domain/sso-ledger-live.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/sso-ledger-live.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/sso-ledger-live.pages.dev/
Last updated: 2026-03-22