connect-ledgrlive-auths[.]pages[.]dev

The domain connect-ledgrlive-auths.pages.dev was identified as a brand impersonation threat specifically targeting Ledger, a popular hardware cryptocurrency wallet provider. This phishing domain was designed to deceive users into believing they were visiting the legitimate Ledger Live platform, likely aiming to steal recovery phrases or login credentials. The page title retrieved was "Ledger® Live — Download," a clear attempt to mimic the official Ledger Live download page.

Technical analysis reveals that this domain resolved to IP address 188.114.97.3 and was registered through Cloudflare, Inc. on March 22, 2026. Its SSL certificate was issued by Google Trust Services (WE1), which is common for Cloudflare-proxied sites. VirusTotal data shows that 10 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. Notably, the domain was not listed on Google Safe Browsing at the time of analysis, though it may have been since added.

As of the latest check, connect-ledgrlive-auths.pages.dev is offline, suggesting that either the hosting provider or domain registrar took action to suspend the site. However, the risk remains elevated because similar domains may still be active or new ones could appear. Users are strongly advised to always verify URLs before entering sensitive information, especially when dealing with cryptocurrency platforms. PhishDestroy recommends bookmarking official websites and enabling two-factor authentication to mitigate the impact of such impersonation attempts.