connect-leadr-live-download-us[.]pages[.]dev

This domain, connect-leadr-live-download-us.pages.dev, poses a brand impersonation threat targeting users of Ledger hardware wallets. The site mimics the official Ledger Live application download page, presenting an identical interface to deceive victims into installing malicious software. Such counterfeit applications are designed to harvest cryptocurrency wallet credentials, private keys, or seed phrases, enabling unauthorized access to digital assets. The page title, 'Ledger Live Download – Manage Multiple Crypto Assets in One App,' reinforces the deception by replicating legitimate branding and functionality claims. Analysis indicates the domain was registered on September 24, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. It is currently flagged by 6 out of 95 security vendors on VirusTotal, with one active blocklist entry (PhishDestroy). The domain employs HSTS and HTTP/3 protocols, alongside a Google Trust Services SSL certificate, which may lend an appearance of legitimacy. Despite these technical features, the Gridinsoft trust score of 0/100 underscores its malicious intent. Infrastructure review confirms the domain was taken offline, though residual risks remain for users who may have interacted with it prior to deactivation. Users who visited connect-leadr-live-download-us.pages.dev or downloaded files from the site should immediately cease all interactions with the domain. Any installed applications should be removed, and systems scanned for malware using updated security tools. Cryptocurrency wallet holders are advised to transfer assets to new, secure wallets and revoke any compromised credentials or connected applications. Monitor financial accounts for unauthorized transactions and enable multi-factor authentication where available. If private keys or seed phrases were entered, consider all associated wallets compromised and take immediate steps to secure remaining assets.