access-ledgrcom-eng[.]pages[.]dev

PhishDestroy identifies access-ledgrcom-eng.pages.dev as an elevated-risk credential theft domain actively masquerading as Ledger’s login portal to harvest wallet seed phrases and private keys. The fraudulent site presents a convincing replica of Ledger Live’s interface, tricking users into surrendering sensitive cryptocurrency wallet credentials under the guise of a mandatory update or security check. This domain was flagged by 1 out of 95 VirusTotal security engines, is hosted by Cloudflare on IP 172.66.44.80, and uses a Google Trust Services certificate to appear legitimate. The Cloudflare Pages subdomain (pages.dev) indicates rapid deployment to evade detection, while the generic “ledgrcom-eng” path attempts to blend with legitimate Ledger domains and lower user suspicion. It has not yet appeared on widely known blocklists, but its SSL issuer and low detection ratio suggest it is a recently launched operation targeting small-scale cryptocurrency holders. If you suspect interaction with this site, immediately transfer remaining funds to a clean wallet using a device not used to access the suspicious link. Never enter wallet recovery phrases or private keys on any page accessed through unsolicited emails or social media links. Report the domain to Google Safe Browsing and Ledger’s phishing team to help protect others, and consider revoking any keys previously entered. Always verify URLs via official Ledger channels before entering credentials.