download-legor-live[.]pages[.]dev

This domain, download-legor-live.pages.dev, is actively engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The page presents itself as the official Ledger Live application download portal, using the title 'Ledger Live Download | Get the Official Crypto App' to deceive users into believing they are accessing legitimate software. Analysis indicates no explicit crypto drainer kit is embedded at the time of assessment, though the domain’s structure and content align with typical brand impersonation tactics designed to harvest credentials or distribute malicious payloads. Infrastructure analysis reveals the domain resolves to the IP address 172.66.47.126, geolocated to Cloudflare, Inc. infrastructure in Canada. The domain was registered through Cloudflare, Inc. on May 01, 2026, an anomalous creation date suggesting potential manipulation or misconfiguration. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare’s services. Detection metrics indicate 11 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. Google Safe Browsing (GSB) status remains unconfirmed at this time. The domain remains active, posing a high risk to users seeking Ledger’s official software. No takedown or suspension has been observed, and the infrastructure continues to resolve without interruption. Response actions should include immediate reporting to the registrar for suspension, dissemination of indicators of compromise (IOCs) to threat intelligence platforms, and user education to verify official download sources. The remaining risk is substantial due to the domain’s persistence, Cloudflare’s hosting resilience, and the targeted nature of the impersonation, which may lead to financial loss or unauthorized access to cryptocurrency wallets.