ledgr-live-guid[.]pages[.]dev

ledgr-live-guid.pages.dev was flagged by PhishDestroy’s automated pipeline (seed 5e8131) for active brand impersonation targeting Ledger users. The domain mimics the legitimate Ledger service under a Cloudflare Pages subdomain, suggesting an attempt to harvest credentials or seed phrases via fake login or recovery pages. No drainer kit artifacts were observed in initial sandbox runs, but the page structure closely mirrors known Ledger phishing templates. Further behavioral analysis is ongoing to confirm payload delivery methods and exfiltration endpoints. This domain resolves to 172.66.44.56 and leverages a Google Trust Services SSL certificate, increasing its appearance of legitimacy. It was registered through Cloudflare, Inc., and currently shows 7/95 detections on VirusTotal, indicating it remains undetected by most AV engines. No creation date is publicly available due to Cloudflare’s privacy protection, but active hosting has been confirmed since detection. It is not currently flagged in Google Safe Browsing (GSB) and remains absent from most threat intelligence blocklists, highlighting a window of opportunity for threat actors to exploit unaware users. The domain is under active investigation with status tagged as 'active'. PhishDestroy has escalated findings to Cloudflare Trust & Safety and Ledger’s abuse team for takedown. Users are strongly advised to avoid interacting with this domain, verify all URLs before inputting sensitive data, and report any encountered phishing attempts. Remaining risk is considered medium due to low detection rates and high brand trust exploitation potential, though response actions are in progress to mitigate exposure. Regular monitoring continues to track domain behavior and potential payload evolution.