en-liveledgr-auth[.]pages[.]dev

This domain, en-liveledgr-auth.pages.dev, is identified as a brand impersonation threat designed to deceive users of Ledger, a hardware cryptocurrency wallet provider. The site mimics legitimate Ledger authentication pages, likely aiming to harvest sensitive credentials such as recovery phrases, private keys, or wallet passwords. Users who interact with this site risk unauthorized access to their cryptocurrency holdings, leading to potential financial loss through unauthorized transactions or account takeovers. The threat is classified as elevated due to the direct targeting of high-value crypto assets and the use of convincing brand replication techniques. Analysis indicates the domain was registered on October 17, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.90, which is part of AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services under the WE1 intermediate. Detection metrics reveal that 15 out of 95 security vendors on VirusTotal have flagged this domain as malicious, while it also appears on one security blocklist. The page title, 'Suspected phishing site | Cloudflare,' suggests that the hosting provider has already taken preliminary action, though the domain was operational during the initial compromise window. The infrastructure leverages Cloudflare’s content delivery network, which is commonly abused to obscure the true origin of malicious content and evade detection. Users who visited en-liveledgr-auth.pages.dev should assume their credentials or recovery phrases may have been compromised. Immediate steps include disconnecting any connected wallets from the site, revoking all active sessions, and transferring assets to a new, secure wallet. It is critical to avoid reusing passwords or recovery phrases from the compromised interaction. Affected individuals should also monitor their transaction history for unauthorized activity and enable additional security measures, such as multi-factor authentication, where applicable. If sensitive information was entered, consider reporting the incident to relevant financial or cybersecurity authorities to assist in broader threat mitigation efforts.