ledger-live-downl-en[.]pages[.]dev

Analysis of ledger-live-downl-en.pages.dev, observed on July 24, 2026, indicates a brand‑impersonation campaign targeting Ledger users. The domain, registered through Cloudflare, Inc. on March 23, 2026, resolves to IP address 188.114.97.3, a Cloudflare node located in Canada. DNS configuration lists the authoritative nameservers hassan.ns.cloudflare.com and tina.ns.cloudflare.com, confirming the hosting provider’s involvement. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 root, and HTTP response headers reveal enforcement of HSTS, support for HTTP/3, and a 403 status code at the time of observation, suggesting the content has been taken offline.

The page title returned by the server reads "Ledger Live - Download Crypto Wallet App," directly aligning with the declared brand target of Ledger and the reported scam type of a crypto‑related fraud. Security telemetry shows the domain appears on a single blocklist (PhishDestroy) and has been flagged by 15 of 94 vendors on VirusTotal, reflecting moderate detection consensus. Additionally, a Gridinsoft trust score of 0/100 reinforces the malicious assessment.

While the page content beyond the title has not been captured, the combination of brand‑specific title, low trust score, vendor detections, and blocklist listing provides concrete evidence of a credential‑theft or malware distribution attempt masquerading as a Ledger download portal. Defenders should add the domain to network‑level blocklists, monitor for similarly structured subdomains under the pages.dev namespace, and enforce strict outbound filtering for any Ledger‑related download URLs. Continuous re‑scanning is advised to capture any re‑activation, given the current offline status may be temporary.