ledgor--live[.]pages[.]dev

PhishDestroy identifies ledgor--live.pages.dev as an active brand-impersonation scam targeting Ledger users. The domain is currently under investigation; it poses as the official Ledger website to harvest seed phrases, private keys, and wallet credentials. All evidence indicates this is an active campaign rather than a parked or abandoned page.

This domain was flagged by zero of ninety-five VirusTotal vendors as of the last scan, indicating it remains undetected by mainstream security engines. It is registered through Cloudflare, Inc., resolving to IP address 172.66.47.199 and secured with a Google Trust Services SSL certificate. The page uses Cloudflare Pages hosting, which provides anonymity and rapid infrastructure shifts, complicating takedown efforts. No public blocklist entries or historical detections were found, suggesting a recently deployed or highly targeted operation.

Ledger users should immediately cease any interaction with ledgor--live.pages.dev and verify all bookmarked links point to ledger.com. Block the domain at DNS and firewall levels, and warn any colleagues or community members who may have received similar lures. Monitor wallet addresses and seed phrases for signs of compromise. If credentials were entered, revoke all associated keys and migrate assets to new wallets with freshly generated seeds. Report the domain to Cloudflare Trust & Safety and Ledger’s phishing inbox to accelerate deactivation.