en-ledge-load[.]pages[.]dev

This domain is under investigation for brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The site presents itself as an official source for Ledger Live software downloads, posing a direct threat to users seeking to secure crypto assets. The impersonation attempt aims to distribute malicious software or harvest credentials under the guise of legitimate wallet management tools. Analysis indicates the domain was registered through Cloudflare, Inc. on April 21, 2026, resolving to IP address 172.66.47.148. It appears on a single security blocklist (PhishDestroy) but currently shows 0/95 detections on VirusTotal. Infrastructure review reveals the use of HSTS, HTTP/3, and a Google Trust Services SSL certificate. The Gridinsoft trust score for this domain is 0/100, reflecting high-risk indicators. Despite being offline at the time of assessment, the domain previously displayed the page title 'Ledger Live Download - Secure Your Crypto Assets,' reinforcing its fraudulent intent. Mitigation requires immediate action from security teams and end users. Network administrators should block the domain and associated IP (172.66.47.148) at perimeter defenses. Users should verify all Ledger-related downloads exclusively through the official ledger.com domain or verified app stores. Cryptocurrency holders must treat unsolicited download links with extreme caution, particularly those distributed via email or social media. Organizations should monitor for connections to en-ledge-load.pages.dev in proxy logs and endpoint telemetry, as this may indicate compromised systems attempting to fetch secondary payloads.