en-us-ledgar-download[.]pages[.]dev

The domain en-us-ledgar-download.pages.dev is currently active and is involved in a brand impersonation scam targeting Ledger. Analysis indicates that the domain was registered through Cloudflare, Inc. and is hosted in California, USA, also via Cloudflare. The domain resolves to the IP address 172.66.44.159. The page title of the site reads 'Ledger Live Download®: Secure Cryptocurrency Management,' which is designed to mislead users into believing they are accessing a legitimate Ledger service. The exact content of the webpage has not been analyzed, but the page title suggests it is likely a fraudulent attempt to distribute malware or steal user credentials under the guise of a legitimate Ledger Live download page.

The SSL certificate for this domain is issued by Google Trust Services, providing an additional layer of perceived legitimacy. However, the site is flagged by 8 out of 91 security vendors on VirusTotal, indicating a notable level of suspicion. The domain also appears on one security blocklist, and it has a Gridinsoft trust score of 0 out of 100, which is the lowest possible score, indicating a high risk. Defenders should block this domain and warn users to avoid visiting it. Any download links or forms on this site should be treated as potentially harmful.

The domain was created on April 30, 2026, and is currently still active. Given the risk level and the technologies in place, such as HSTS and HTTP/3, it is advised to monitor this domain for further malicious activities and to ensure that all security measures are up to date to protect against potential threats. The site is not currently listed in the Google Safe Browsing database or AlienVault OTX, which may indicate that it is a relatively new or niche threat. Nonetheless, the high risk level and the use of a known brand impersonation technique should be taken seriously. Users should always verify the URL and use official Ledger channels for downloading software or managing their cryptocurrency.