signup-ldgr-app[.]pages[.]dev

PhishDestroy has opened an investigation into signup-ldgr-app.pages.dev, a Cloudflare Pages domain currently distributing a credential-theft campaign masquerading as a Ledger wallet login portal. The page leverages a spoofed UI to harvest seed phrases and private keys from cryptocurrency users. While no drainer kit artifacts were publicly available at time of analysis, the domain’s layout and form fields closely mimic Ledger’s official recovery interface, indicating a high-fidelity impersonation designed to deceive even security-aware users. The infrastructure is provisioned under Cloudflare’s Pages service, enabling rapid deployment and evasion of legacy blocklists that focus on traditional hosting providers.

Technical indicators confirm a low detection profile but do not guarantee safety. VirusTotal currently reports 0 detections out of 95 engines as of the latest scan. The domain resolves to IP 172.66.44.77 via Cloudflare’s Anycast network and is secured with a Google Trust Services SSL certificate. The page was registered through Cloudflare, Inc., though the exact creation date is obscured by Cloudflare’s privacy-preserving registration service. Google Safe Browsing (GSB) has not yet flagged this domain, and third-party threat intelligence platforms report zero blocklist inclusions. These characteristics suggest a recently activated campaign still in its early propagation phase.

As of this report, the threat is active with minimal detection coverage, posing elevated risk to cryptocurrency users. PhishDestroy has escalated this domain to our real-time takedown partner and notified Ledger’s security team. Users are strongly advised to avoid interacting with any links or pages associated with signup-ldgr-app.pages.dev. Always verify URLs using official channels and enable hardware wallet authentication where possible. Remaining risk is assessed as high due to unflagged status and active distribution.