new-ledgr-live-io-auth[.]pages[.]dev

Analysis of the domain new-ledgr-live-io-auth.pages.dev indicates it was actively impersonating Ledger, a cryptocurrency hardware wallet provider, as of July 25, 2026. The domain was registered on March 23, 2026, through Cloudflare, Inc., and resolved to the IP address 188.114.96.3, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the site employed HSTS and HTTP/3 technologies, alongside Cloudflare's infrastructure. The page title, 'Ledger com Start - Secure Your Crypto,' explicitly references Ledger, aligning with the known scam type classified as a crypto scam in available threat intelligence. The domain was flagged by 12 of 94 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in the available data.

It appeared on at least one security blocklist and was blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. As of the report date, the domain returned an HTTP 403 status, indicating it was taken offline or restricted, though the exact cause—whether due to enforcement action, infrastructure changes, or other factors—remains unclear. Defenders should treat this domain as part of a broader pattern of Ledger-branded phishing campaigns targeting cryptocurrency users.

The use of Cloudflare hosting and a Google-issued SSL certificate does not mitigate the domain's malicious intent, as these are commonly abused by threat actors to lend false legitimacy. Organizations should ensure this domain is blocked at the DNS and network levels, and monitor for related infrastructure, such as similarly named subdomains or newly registered domains under Cloudflare Pages. If historical logs or user reports indicate interaction with this domain, immediate incident response measures—such as credential resets, wallet address verification, and device scans—are recommended for affected users.