ledger-live-auth-us[.]pages[.]dev

This domain, ledger-live-auth-us.pages.dev, is actively serving a web page titled "Ledger Live Wallet – Secure Crypto & NFT Management." The site resolves to IP 188.114.97.3, an address owned by Cloudflare, Inc. in Canada, and returns HTTP 200 with HSTS enabled and HTTP/3 support. The SSL certificate is issued by Google Trust Services under the WE1 designation, indicating a valid TLS chain but offering no protection against the underlying content. The domain was registered on 30 April 2026 through Cloudflare, Inc., and uses the Cloudflare nameservers emely.ns.cloudflare.com and sid.ns.cloudflare.com. Reputation data shows a Gridinsoft trust score of 0 / 100 and placement on one security blocklist. VirusTotal analysis reports 11 of 91 scanners flagging the domain, consistent with its classification as a brand‑impersonation campaign targeting Ledger. The page title explicitly references Ledger, and the intelligence tags the site as impersonating the Ledger brand. Current mitigation status indicates that PhishDestroy has added the domain to its blocklist, yet the site remains reachable. No additional payload, credential‑capture mechanisms, or malicious binaries have been observed in the available data. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and alert users about unsolicited requests purporting to be Ledger Live authentication pages. Ongoing analysis is required to determine whether the site hosts credential‑stealing forms or redirects to secondary malicious infrastructure.