base-ledgr-live-download[.]pages[.]dev

The domain base-ledgr-live-download.pages.dev was registered on April 30, 2026 and resolves to the Cloudflare IP address 172.66.44.211, indicating that the attacker is leveraging Cloudflare's CDN and DNS services (gloria.ns.cloudflare.com, leo.ns.cloudflare.com). The site serves content over HTTPS using a Google Trust Services certificate and enforces HSTS, while also supporting HTTP/3. The page title "Ledger Live Download — Secure Hardware Wallet Management" directly references Ledger's product line, and the threat is classified as a brand impersonation targeting Ledger users. VirusTotal scans show five of ninety-one security vendors flag the domain, and the site appears on one public blocklist; Gridinsoft assigns a trust score of zero out of one hundred, and PhishDestroy has already blocked the domain. Infrastructure analysis reveals no additional hosting clues beyond the Cloudflare front‑end, and no further malicious payloads have been publicly disclosed. The combination of recent domain creation, targeted branding, and multiple vendor detections elevates the risk to high, and defenders should treat any traffic to this domain as malicious. Recommended actions include adding the domain to network deny lists, monitoring DNS queries for the associated IP range, and alerting end‑users about the fraudulent Ledger Live download attempt. Continuous re‑evaluation is advised as additional intelligence may emerge.