download-ledgr-en-us[.]pages[.]dev

This domain, download-ledgr-en-us.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live download page, titled 'Ledger Live Download | Secure Crypto Wallet App,' likely to distribute malware or harvest credentials. The infrastructure is designed to deceive users into installing malicious software under the guise of a legitimate crypto wallet application, posing significant financial and data security risks. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with a creation date of April 24, 2026, suggesting recent deployment for malicious purposes. It resolves to the IP address 172.66.44.166, hosted under Cloudflare’s network in Canada. VirusTotal detection shows 1 out of 95 security vendors flagging the domain, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing sites. No Google Safe Browsing (GSB) flags are currently recorded, though this may reflect detection latency rather than benign status. The domain remains active as of the latest verification, with no takedown or sinkholing observed. Users are advised to avoid interaction, as the site may deploy credential harvesters or wallet drainers upon download. Organizations should update blocklists to include this domain and its resolving IP, while monitoring for related infrastructure. Given the low detection rate but high-risk context, manual verification of Ledger-related downloads is critical to mitigate exposure. The remaining risk is elevated due to the domain’s operational status and targeted impersonation of a high-value crypto asset brand.