at-ledger-downlaod[.]pages[.]dev

This domain, at-ledger-downlaod.pages.dev, is actively engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The site presents itself as the official Ledger Live Desktop platform, using the page title 'Ledger Live Desktop® — Secure Crypto Management™ Platform' to deceive users into downloading malicious software. Analysis indicates this is not a generic phishing attempt but a targeted effort to compromise crypto asset management, likely deploying a wallet drainer or credential harvester upon interaction. Infrastructure analysis reveals the domain is hosted on Cloudflare Pages, resolving to the IP address 188.114.97.3 with an SSL certificate issued by Google Trust Services (WE1). The domain was registered through Cloudflare, Inc., with a creation date of April 30, 2026, which may indicate an attempt to appear legitimate or evade detection. VirusTotal detection shows 1 out of 95 security vendors flagging the domain, while it appears on a single security blocklist. The domain is not currently listed on Google Safe Browsing, suggesting limited prior reporting or recent activation. As of the latest verification, at-ledger-downlaod.pages.dev remains active, posing a high risk to users seeking Ledger software. The domain has been blocked by PhishDestroy, but no additional takedown actions have been confirmed. Users are advised to verify the authenticity of Ledger-related downloads exclusively through the official ledger.com domain. Organizations should monitor for connections to 188.114.97.3 and the associated SSL certificate thumbprint in network logs to identify potential compromise. The remaining risk is elevated due to the domain's operational status and the high-value target of cryptocurrency users.