support-ledger-com-auths[.]pages[.]dev

Analysis of the domain support-ledger-com-auths.pages.dev indicates a confirmed phishing campaign impersonating Ledger, a cryptocurrency hardware wallet provider. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolves to IP address 172.66.47.89, hosted on Cloudflare's network (AS13335) in the United States. As of July 24, 2026, the domain returns an HTTP 403 status, with Cloudflare serving a page titled 'Suspected phishing site,' a standard response for flagged content on their platform. Infrastructure review reveals the domain uses Cloudflare nameservers (newt.ns.cloudflare.com and bethany.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1).

Detection data shows the domain appears on one security blocklist, with PhishDestroy actively blocking it. Scamadviser and Gridinsoft assign trust scores of 1/100 and 0/100, respectively, further indicating malicious intent. VirusTotal reports nine detections from 93 security vendors, confirming its classification as a phishing threat. The domain is explicitly categorized as a crypto scam, aligning with Ledger's brand targeting.

While the exact content of the phishing page remains unanalyzed, the available evidence—including the domain structure, brand impersonation, and detection metrics—supports its classification as a high-risk threat. Defenders should treat this domain as compromised and maintain blocklist entries to prevent user exposure. Given its current offline status, continuous monitoring is recommended to detect potential reactivation or shifts in infrastructure.