ledgere-live-auth[.]pages[.]dev

The domain ledgere-live-auth.pages.dev has been identified as a brand impersonation phishing site specifically targeting Ethereum users through a fraudulent crypto wallet management interface. Analysis indicates the site masquerades as the legitimate Ledger Live application, a platform for secure cryptocurrency wallet management. The domain is currently offline, but prior activity suggests it was designed to deceive users into disclosing sensitive credentials or installing malicious software under the guise of a trusted service. Infrastructure analysis reveals the domain was registered on September 11, 2025, through Cloudflare, Inc., and resolves to the IPv6 address 2606:4700:310c::ac42:2f97, hosted on Cloudflare’s network (AS13335). Detection metrics show the domain was flagged by 10 of 95 security vendors on VirusTotal, with one confirmed entry on a security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s infrastructure. The page title, "Ledger Live - Secure Crypto Wallet Management App Download," directly mimics the branding of the official Ledger Live application, reinforcing its deceptive intent. The risk level for this domain is assessed as elevated due to its direct targeting of cryptocurrency users and the potential for credential theft or malware distribution. While the domain is currently offline, users who may have interacted with it are advised to revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and verify the authenticity of any software downloads through official channels. Organizations should update blocklists to include this domain and its associated indicators of compromise, including the IPv6 address and SSL certificate issuer, to prevent future exposure.