io-download-ledge[.]pages[.]dev

This domain, io-download-ledge.pages.dev, is identified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live download portal, likely designed to distribute malicious software or harvest credentials from unsuspecting users. The page title, 'Ledger Live Download | Secure Crypto Management,' reinforces the deception by closely replicating legitimate branding and terminology associated with Ledger’s official platform. Infrastructure analysis reveals the domain was registered on October 28, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.46.247, hosted on Cloudflare’s network (AS13335). The domain is flagged by 19 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and uses an SSL certificate issued by Google Trust Services (WE1). The IP geolocation is listed as the United States, though this may reflect Cloudflare’s proxy infrastructure rather than the actual origin. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to end users. However, the infrastructure remains registered and could be reactivated or repurposed for similar campaigns. Organizations and individuals are advised to monitor for residual DNS caching, update blocklists to include this domain and associated IP, and conduct retroactive scans for any interactions with the site. Users who may have accessed the domain should assume credential compromise and take steps to secure affected accounts, including revoking active sessions and rotating passwords or cryptographic keys.