leadgarlivedownloads[.]pages[.]dev

The domain leadgarlivedownloads.pages.dev was registered on 2026-06-09 through Cloudflare Pages and is currently hosting a site titled “Ledger Live Download: Official FREE App | 30-Second Install Guide”. The page claims to offer a Ledger Live application, indicating a brand-impersonation campaign targeting Ledger users. Infrastructure analysis shows the domain resolves to IP 172.66.44.104, a Cloudflare edge node located in Canada. The TLS certificate is issued by Google Trust Services under the WE1 authority, confirming the use of legitimate HTTPS by the attacker. HTTP requests return status 200, indicating the site is actively serving content. Malware and phishing detection services have begun to flag the domain: PhishDestroy has blocked it, it appears on one public blocklist, and VirusTotal reports 11 of 91 security vendors flagging the host. Gridinsoft assigns a trust score of 0 / 100, reflecting a high confidence of malicious intent. The campaign is listed as active and high-risk. No additional malicious payloads or redirects have been observed, and the exact content beyond the page title remains unverified. Defenders should block DNS resolution to leadgarlivedownloads.pages.dev, add the IP address 172.66.44.104 to network-level deny lists, and monitor for similar Cloudflare-Pages subdomains that reference Ledger. Continuous scanning with multi-engine services is recommended to capture any future changes to the site’s payload or hosting configuration.