ledge-live-download[.]pages[.]dev

PhishDestroy identifies ledge-live-download.pages.dev as an active phishing domain masquerading as a legitimate streaming platform’s download page. The site leverages Cloudflare Pages hosting under the domain pages.dev to evade traditional IP-based blocklists while presenting a convincing copy of a well-known service’s download interface. Traffic to this fraudulent endpoint typically originates from malvertising campaigns or deceptive social media links advertising so-called "exclusive" live event streams that require a software download. Upon interaction, victims are prompted to run an executable that installs unwanted adware, browser hijackers, or steal authentication tokens, leading to account takeovers on the impersonated platform. This domain was flagged due to zero detections in the VirusTotal community feed—scanned across 95 detection engines as of the latest intelligence update. The domain is registered through Cloudflare, Inc., resolving to IP 188.114.97.3 with a valid SSL certificate issued by Google Trust Services. The certificate chain shows no anomalies, and the site uses HTTPS to appear legitimate. Indicators suggest this phishing page may be part of a broader campaign targeting users seeking live sporting events or exclusive media content, with recent upticks in traffic observed across multiple security telemetry platforms. Users who visited ledge-live-download.pages.dev should immediately cease any interaction with the site and avoid downloading any files or entering credentials. Run a full antivirus scan and check for unauthorized browser extensions or suspicious processes. If any login tokens were entered, assume compromise and reset passwords on all related accounts immediately. Report the domain to your security provider and use network monitoring tools to detect lateral movement. Do not reopen the page in any browser, as it may exploit active content to deliver further malware payloads.