auths-ledgr[.]pages[.]dev

This domain, auths-ledgr.pages.dev, is identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The phishing page mimics the official Ledger interface, presenting itself under the title "Ledger Wallet Official | Protect" to deceive users into disclosing sensitive credentials or wallet recovery phrases. No specific drainer kit signatures were detected in initial scans, but the domain exhibits characteristics consistent with credential harvesting infrastructure. The page employs social engineering tactics, likely aiming to exploit trust in the Ledger brand to facilitate unauthorized access to cryptocurrency assets.

Analysis indicates the domain was registered on September 26, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.164. VirusTotal reports 8 out of 95 security vendors flagging this domain as malicious, while it appears on a single security blocklist. The domain is hosted on Cloudflare infrastructure, utilizing HTTP/3 and HSTS protocols, with an SSL certificate issued by Google Trust Services. Google Safe Browsing (GSB) does not currently list this domain, though its presence on one blocklist and the VirusTotal detection rate suggest active malicious intent. The Gridinsoft trust score for this domain is 0/100, reinforcing its classification as a high-risk asset.

As of the latest assessment, auths-ledgr.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or domain registrar. The domain's removal reduces immediate exposure, but residual risk remains for users who may have interacted with the site prior to its takedown. Organizations are advised to monitor network logs for connections to 172.66.47.164 and the domain itself, as well as to review endpoint telemetry for signs of credential compromise. Users should be alerted to verify the authenticity of any Ledger-related communications and avoid entering sensitive information on unverified platforms. Further investigation into associated infrastructure may reveal additional linked domains or IPs involved in this campaign.