ledgrcom-auth-io[.]pages[.]dev

This domain is classified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The site presents itself as a legitimate Ledger resource, using the page title 'Ledger Start Guide | Protect Your Crypto Assets' to deceive users into entering sensitive credentials or recovery phrases, potentially leading to unauthorized access and asset theft. Analysis indicates the domain ledgrcom-auth-io.pages.dev was registered through Cloudflare, Inc. on April 29, 2026, and resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare infrastructure. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns leveraging legitimate CDN providers. The domain appears on one security blocklist, PhishDestroy, and is flagged by Google Safe Browsing as phishing. VirusTotal reports 13 out of 95 security vendors detecting the domain as malicious, suggesting moderate but growing detection coverage. The creation date discrepancy (2026) may indicate an attempt to evade age-based reputation filters. Mitigation requires immediate action from network defenders and end users. Security teams should block the domain and IP 188.114.96.3 at perimeter controls, including firewalls and DNS filters. Cryptocurrency users should verify all Ledger-related communications by accessing official channels directly via ledger.com, avoiding links from emails or third-party sites. Organizations should monitor for connections to the domain in proxy logs and endpoint telemetry. Given the use of Cloudflare Pages, defenders should also review other subdomains under pages.dev for similar threats. Users who may have interacted with the site should revoke active sessions, rotate credentials, and monitor wallet transactions for unauthorized activity.