auths-liveledgr-fqs[.]pages[.]dev

This domain, auths-liveledgr-fqs.pages.dev, presents a confirmed brand impersonation threat targeting Ledger cryptocurrency wallet users. The site mimics the official Ledger Live download portal, displaying the page title 'Ledger™ Live: Download | Getting Started Ledger™' to deceive visitors into downloading malicious software. Analysis indicates the domain is designed to harvest sensitive credentials or distribute malware under the guise of legitimate wallet installation files, posing a direct risk to cryptocurrency asset security. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 30, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. It currently resolves to the IP address 172.66.47.113, hosted in Canada under Cloudflare's network. Despite its active status, the domain remains undetected by major security engines, with a VirusTotal score of 0/95. It appears on only one security blocklist, indicating limited visibility in threat intelligence feeds. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting users. Users who have visited auths-liveledgr-fqs.pages.dev or interacted with its content should immediately cease all engagement and perform a thorough security review. Any downloaded files from this domain must be treated as malicious and deleted without execution. Affected systems should undergo a full antivirus scan using updated definitions, and all Ledger-related credentials should be reset from a secure device. Cryptocurrency wallet users are advised to verify domain authenticity through official channels before downloading software, particularly when prompted by unsolicited links or search results.