legerlivedownload[.]pages[.]dev

Analysis of legerlivedownload.pages.dev indicates an active brand‑impersonation campaign targeting Ledger. The domain was registered on 2026‑04‑06 and is hosted behind Cloudflare, resolving to IP 188.114.97.3 located in Canada. DNS is served by anirban.ns.cloudflare.com and sue.ns.cloudflare.com. The site presents a page title “Get Started with Ledger - Secure Your Cryptocurrency with Ease” and serves a valid TLS certificate issued by Google Trust Services under the WE1 chain, confirming encrypted HTTP (status 200). Infrastructure signals include a Gridinsoft trust score of 0/100 and inclusion on a single security blocklist; the domain is also listed by PhishDestroy. VirusTotal scans show six of ninety‑four antivirus engines flagging the domain, reinforcing the malicious classification. The available data confirm the domain’s intent to masquerade as an official Ledger resource, but content beyond the title has not been examined, leaving the exact phishing mechanics unknown. Defenders should treat the domain as high‑risk: block the FQDN at perimeter and DNS layers, add the IP to threat‑intel feeds, monitor for similar Cloudflare‑hosted subdomains, and educate users to verify Ledger URLs before entering credentials or cryptocurrency information.