auth-ledger-live-wallet-en-us[.]pages[.]dev

This domain auth-ledger-live-wallet-en-us.pages.dev was registered on March 23 2026 through Cloudflare, Inc. The authoritative nameservers are kia.ns.cloudflare.com and wesley.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. DNS resolution points to IP 172.66.47.178, an address owned by Cloudflare in Canada. The site presented an HTTPS endpoint secured by a Google Trust Services certificate (WE1) and advertised HSTS and HTTP/3 support. An HTTP request returned status code 403, and the site is currently taken offline, as confirmed by the PhishDestroy takedown and the fact that it appears on a single security blocklist.

VirusTotal analysis recorded 14 detections out of 94 scanned scanners, and Gridinsoft assigned a trust score of 0 / 100, while Scamadviser gave a score of 41 / 100, both indicating a high likelihood of malicious intent. The page title “Ledger Live Wallet — Secure Crypto Management” and the explicit “Impersonates: Ledger” field identify the campaign as a brand‑impersonation crypto scam targeting users of Ledger’s hardware wallet ecosystem. No further technical artefacts such as malicious payloads, credential‑harvesting forms, or redirection URLs have been disclosed, leaving the exact phishing workflow uncertain. Defenders should block the domain and its associated IP at perimeter and DNS layers, monitor for any DNS queries to the Cloudflare nameservers, and add the domain to internal threat intelligence feeds.

Since the certificate is issued by a trusted CA, TLS inspection may be required to detect any future re‑hosting of the content. Continuous re‑scanning on VirusTotal and similar services is advised to capture any changes in detection rates. Organizations using Ledger products should alert users to the existence of this impersonation attempt and advise against clicking links that reference “Ledger Live Wallet” from unsolicited communications.