web-ledger-login-auth[.]pages[.]dev

PhishDestroy has identified web-ledger-login-auth.pages.dev as a brand impersonation threat specifically targeting Ledger users. This domain, which is currently offline, was designed to mimic a legitimate Ledger login page in order to harvest cryptocurrency wallet credentials. The site was registered through Cloudflare, Inc. on September 08, 2025, and resolved to IP address 172.66.44.215 before being taken down.

Technical analysis reveals that this domain was flagged by 9 out of 95 VirusTotal vendors, indicating a significant level of detection across the security community. It appears on one security blocklist and its SSL certificate was issued by Google Trust Services / WE1. The page title observed was "Suspected phishing site | Cloudflare," confirming that Cloudflare itself had intervened to block the malicious content. The domain was created very recently, a common tactic used by threat actors to evade detection.

As of the latest check, the domain is offline, likely due to takedown actions by Cloudflare or law enforcement. However, users should remain vigilant as similar phishing sites may reappear under different domains. PhishDestroy strongly recommends that Ledger users always verify the authenticity of any login page by navigating directly to the official Ledger website and never clicking on links from unsolicited emails or messages. If you have already entered credentials on this site, change your wallet passwords immediately and enable two-factor authentication. For further safety, use PhishDestroy's verification tools before interacting with any crypto-related websites.