# web-ledgr-live-io-sso.pages.dev — SUSPICIOUS

> PhishDestroy identifies web-ledger-live-io-sso.pages.dev as a crypto credential theft scam; VirusTotal shows 0/95 detections as of today.

## Summary
PhishDestroy identifies the domain web-ledger-live-io-sso.pages.dev as a live active crypto credential theft scam designed to harvest wallet keys and seed phrases under the false branding of a popular crypto ledger service provider. Visitors are lured through impersonated SSO login portals that closely mimic legitimate Ledger Live pages, tricking users into entering sensitive account recovery information which attackers immediately exfiltrate to steal digital assets. The scam abuses Cloudflare Pages hosting and leverages a Google-issued SSL certificate to appear authentic, undermining user trust in secure indicators.


This domain was flagged by PhishDestroy after analysis revealed multiple red flags: it resolves to IP 172.66.47.27, is registered via Cloudflare Inc., and currently shows 0 detections across 95 VirusTotal engines despite Google Safe Browsing classifying it as SOCIAL_ENGINEERING. The site abuses Cloudflare Pages infrastructure to host spoofed login interfaces and leverages a Google Trust Services SSL certificate to mimic legitimate cryptocurrency platform security, increasing the likelihood of user deception. Technical indicators include the use of a Cloudflare Pages domain pattern (pages.dev) commonly exploited in credential harvesting campaigns, and the presence of SSO-themed social engineering tactics targeting users of major crypto platforms.


If you accessed or entered any information on web-ledger-live-io-sso.pages.dev, immediately stop using the affected wallet or account and transfer all digital assets to a newly generated wallet not associated with the compromised credentials. Revoke any connected permissions for the site and enable two-factor authentication on all crypto-related accounts. Scan your device for malware using trusted antivirus tools, and consider a full system reset if you entered sensitive information like seed phrases. Report the domain to your email provider and the crypto platform being impersonated to aid in blocking and takedown efforts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.27

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: FLAGGED
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/39602e11-3bc8-4000-a105-b3c309e02a62
- PhishDestroy: https://phishdestroy.io/domain/web-ledgr-live-io-sso.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/web-ledgr-live-io-sso.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/web-ledgr-live-io-sso.pages.dev/
Last updated: 2026-03-24