app-ledgr-downloadio[.]pages[.]dev

The domain app-ledgr-downloadio.pages.dev was registered on May 01, 2026 and currently resolves to the Cloudflare‑owned IP address 172.66.44.68. It is served through Cloudflare’s infrastructure, indicated by the presence of HSTS, HTTP/3 support and a Google Trust Services / WE1 SSL certificate. The authoritative name servers listed are adrian.ns.cloudflare.com and aiden.ns.cloudflare.com, confirming Cloudflare as the hosting provider. The site returns HTTP 200 and the page title reads “Ledger Live – Secure Crypto Management Platform,” directly referencing the Ledger brand. Threat intelligence classifies the site as a brand‑impersonation campaign targeting Ledger users. A Gridinsoft trust score of 0 / 100 and detection by three of ninety‑one VirusTotal scans reinforce the malicious assessment, while the domain appears on at least one public blocklist and has been flagged by PhishDestroy. Although the page content has not been examined, the available metadata is consistent with a credential‑ harvesting operation that aims to lure Ledger customers. Defenders should add the domain and its resolving IP to blocklists, monitor DNS queries for the associated Cloudflare name servers, and enforce strict outbound filtering for connections to this host. Email security gateways should be updated to flag any messages containing links to the domain, and user awareness campaigns should remind Ledger users that official communications never originate from a pages.dev sub‑domain. Continuous re‑evaluation is advised, as the site remains active and may evolve its tactics.