# wb-ladger-live-start.pages.dev — SUSPICIOUS

> PhishDestroy identifies wb-ladger-live-start.pages.dev as a live ledger phishing site hosted on Cloudflare (IP 172.66.44.175).

## Summary
PhishDestroy identifies wb-ladger-live-start.pages.dev as an active domain engaged in generic phishing, specifically targeting cryptocurrency users by impersonating Ledger Live services. The page is currently resolving to IP 172.66.44.175 via Cloudflare Pages and remains undetected on VirusTotal with 0 out of 95 detections as of the latest scan. This campaign uses a Google Trust Services SSL certificate to enhance credibility while hosting a fraudulent interface designed to harvest wallet credentials and seed phrases.  This domain was flagged under seed 683105 for active phishing activity. It shows no current presence on major blocklists, maintains a neutral reputation, and is registered under Cloudflare, Inc. The low detection rate suggests a recently launched operation likely leveraging dynamic infrastructure to evade early detection. Technical indicators include the use of Pages.dev as a free hosting platform, which is frequently abused in credential-harvesting campaigns, and the assigned Cloudflare IP 172.66.44.175, which falls within a known hosting range for malicious endpoints. While the SSL certificate issued by Google Trust Services may appear legitimate, it is commonly exploited to lend false legitimacy to spoofed login pages.  Users are strongly advised to avoid interacting with wb-ladger-live-start.pages.dev or any links referencing 'Live Ledger' claiming to resolve wallet issues. To mitigate risk, immediately block the domain at DNS and firewall levels, avoid entering credentials on any unsolicited Ledger-related page, and verify official channels—use only ledger.com and verified Ledger Live applications. Report any exposure to wallet compromise to Ledger support and revoke derived permissions through wallet interfaces. Monitor for unauthorized transactions and consider transferring assets to a new wallet if credentials were entered. This campaign poses an immediate but evolving threat; proactive blocking and education are critical to preventing financial loss.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.175

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/a50d1075-edf3-4dd5-a7d8-f7cddceee206
- PhishDestroy: https://phishdestroy.io/domain/wb-ladger-live-start.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/wb-ladger-live-start.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/wb-ladger-live-start.pages.dev/
Last updated: 2026-03-22