ledger-cdn-auths[.]pages[.]dev

Analysis of the domain ledger-cdn-auths.pages.dev confirms its classification as a crypto scam site targeting Ledger, a hardware wallet provider. The domain, registered on March 22, 2026, through Cloudflare, Inc., resolved to IP address 188.114.97.3, hosted by Cloudflare in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (fish.ns.cloudflare.com and keaton.ns.cloudflare.com), HSTS, and HTTP/3 protocols, alongside a Google Trust Services SSL certificate (WE1). The page title, 'Getting Started | Ledger,' aligns with the identified scam type (crypto scam) and brand impersonation of Ledger, as noted in the available intelligence.

Detection data indicates elevated risk: the domain appears on one security blocklist and is flagged by 13 of 94 security vendors on VirusTotal. Gridinsoft assigned a trust score of 0/100, further supporting its malicious classification. The domain was blocked by PhishDestroy and is currently offline, returning an HTTP 403 status. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, detection by multiple security vendors, and association with a known scam type provides sufficient evidence for defenders to treat this domain as confirmed malicious.

Defenders should ensure this domain is blocked at the network and endpoint levels, and monitor for related infrastructure, such as associated IP addresses or SSL certificates. Given the use of Cloudflare hosting, additional domains leveraging similar naming conventions (e.g., 'ledger-cdn-*') should be investigated for potential ties to this campaign. No evidence currently links this domain to broader threat actor infrastructure, but historical registration data and SSL certificate details may assist in identifying related activity.