ledger-com-auths-6vq[.]pages[.]dev

The domain ledger-com-auths-6vq.pages.dev was registered on February 21, 2026 and is hosted on Cloudflare infrastructure, using the nameservers augustus.ns.cloudflare.com and eve.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2f82, which belongs to AS13335, the Cloudflare network, and is geolocated to the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming that HTTPS is correctly terminated, but the certificate does not provide any indication of malicious content beyond the standard Cloudflare provisioning. The HTTP response returned a 403 status code, and the page title reported by the server is "Suspected phishing site | Cloudflare," suggesting that the host has already flagged the content as suspicious.

The domain is listed as a crypto‑related scam that impersonates the Ledger brand, and it has been actively blocked by the PhishDestroy service, resulting in its current offline status. VirusTotal analysis shows that 16 out of 93 security vendors have flagged the domain, and it appears on at least one public blocklist, reinforcing the suspicion of malicious activity. Additional telemetry from Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of reputable reputation. Detected technologies include HTTP/3, HSTS enforcement, and Cloudflare's edge services, all of which are typical for legitimate sites but are also leveraged by threat actors to hide malicious payloads behind trusted infrastructure.

While the available data confirms the domain’s association with Ledger impersonation and its inclusion on multiple security blocklists, the exact content delivered to end users has not been captured, leaving the specific tactics used to harvest credentials or funds uncertain. Defenders should continue to block the domain at network perimeters, update URL filtering rules, and monitor for any residual traffic from the associated IPv6 address.