ledger-com-up[.]pages[.]dev

PhishDestroy identifies ledger-com-up.pages.dev as a Ledger-brand impersonation page actively serving credential-stealing content from a Cloudflare-hosted Google Trust Services certificate. ledger-com-up.pages.dev resolves to IP 172.66.46.210 and currently shows 0 detections out of 95 VirusTotal engines. The domain was registered through Cloudflare, Inc., inheriting Cloudflare’s trusted infrastructure while hosting deceptive Ledger branding. This tactic leverages Google’s SSL certificate and Pages.dev subdomain to appear legitimate, masking malicious intent behind a legitimate provider’s infrastructure. Users who visited ledger-com-up.pages.dev risk exposing Ledger account credentials to an unknown threat actor. PhishDestroy notes the campaign remains under investigation, with no blocklist penetration at time of detection. If you entered any Ledger information on this page, revoke the exposed credentials immediately, enable two-factor authentication, and review account activity for unauthorized access. Report the domain to Ledger’s fraud portal and your local cybercrime unit to aid ongoing takedown efforts.