download-ledzr-live[.]pages[.]dev

This domain, download-ledzr-live.pages.dev, is actively serving a brand‑impersonation page targeting Ledger users. The site resolves to 188.114.96.3, an address hosted by Cloudflare, Inc. in Canada, and the TLS certificate is issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS connection. The domain was registered on March 26 2026 through Cloudflare, Inc., and uses Cloudflare nameservers (amit.ns.cloudflare.com, colette.ns.cloudflare.com). HTTP requests return status 200 and the page title reads “Download Ledger Live – The Official Crypto Wallet,” confirming the declared intent. Threat intelligence shows the domain is listed on one security blocklist and has been blocked by PhishDestroy. On VirusTotal, five of ninety‑four scanners flagged the domain, suggesting partial detection. The infrastructure includes HSTS and HTTP/3 support, typical of modern web services. While the page content has not been examined, the combination of a recent registration, a Ledger‑related title, and detection by multiple security sources indicates a high‑risk impersonation campaign. Defenders should add the domain to blocklists, monitor DNS queries for the 188.114.96.3 address, and enforce strict outbound filtering for connections to Cloudflare‑hosted IPs that are not part of authorized services. Continuous re‑scanning and telemetry collection are advised to capture any evolution of the payload or hosting changes.