guide-live-en-hub-us[.]pages[.]dev

PhishDestroy identifies an active Ledger brand-impersonation site hosted on Cloudflare Pages at guide-live-en-hub-us.pages.dev. This fraudulent page (IP 172.66.46.218) uses the falsified title Ledger Live Login | Starting® Up® Your® Device®™ to harvest user credentials under the guise of a legitimate Ledger Live portal. Attackers register lookalike subdomains under pages.dev to exploit the trust associated with Ledger’s brand, tricking victims into entering seed phrases or login details on a counterfeit interface. Technical analysis confirms the domain resolves via Google Trust Services SSL certificates and Cloudflare’s edge network, giving it an initial appearance of legitimacy. Despite zero detections on VirusTotal as of this advisory, the domain remains unblocked and accessible. Further OSINT analysis indicates this domain was registered through Cloudflare, Inc., and has not yet propagated across major threat intelligence feeds, placing early-stage users at heightened risk of credential compromise. Users who accessed this domain should immediately inspect any Ledger-related credentials entered on the page and revoke associated API keys or seed phrases. Disconnect any devices that may have been exposed and perform a factory reset on hardware wallets used during the session. Monitor financial accounts for unauthorized transactions and consider enrolling in identity protection services. Block the domain at DNS and firewall levels using the indicators provided: guide-live-en-hub-us.pages.dev, 172.66.46.218. Report the incident to Ledger’s official support channels and update password managers to exclude any stored Ledger credentials used on untrusted domains.