auth-ldgr-login[.]pages[.]dev

Analysis of auth-ldgr-login.pages.dev indicates that the site was provisioned on March 25 2026 and is presently taken offline. The domain resolves to the Cloudflare‑owned IP address 172.66.47.65, which is geolocated to Canada. Cloudflare’s DNS services are confirmed by the authoritative nameservers mario.ns.cloudflare.com and sara.ns.cloudflare.com, and the SSL certificate presented is issued by Google Trust Services under the WE1 intermediate, showing a valid TLS chain. HTTP responses return a 403 status code, and the server advertises HSTS and HTTP/3 support, consistent with typical Cloudflare‑hosted infrastructure. The page title retrieved during prior scans reads “Ledger Live Wallet — Get Started with Ledger,” directly referencing the Ledger brand.

This, together with the classification “Brand Impersonation” and the explicit “Impersonates: Ledger” tag, demonstrates a deliberate attempt to masquerade as a Ledger service. The domain has been added to one security blocklist and was flagged by PhishDestroy. VirusTotal analysis shows that 12 of 94 scanning engines flagged the domain as malicious, reinforcing the suspicion of abuse. Gridinsoft assigns a trust score of 0 / 100, indicating an extremely low reputation.

Despite the offline status, historical evidence suggests the infrastructure was designed to host a credential‑collection page targeting Ledger users. No additional payload details, hosting of malicious scripts, or secondary C2 infrastructure have been observed, leaving the exact phishing kit unknown. Defenders should continue to block the domain at network perimeter filters, update internal blocklists with the observed IP and nameserver information, and monitor for any re‑registration of similar subdomains under the pages.dev namespace. Continuous observation of Cloudflare‑issued certificates and rapid re‑creation of similar domains is advisable, as threat actors often exploit the ease of provisioning new sites on the same hosting platform.