dev-home-live-download[.]pages[.]dev

The domain dev-home-live-download.pages.dev is actively engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. This infrastructure is designed to deceive users into disclosing sensitive credentials or downloading malicious software under the guise of the legitimate Ledger Live application. The page title, "Ledger Live Download – Secure Crypto Desktop Wallet," reinforces the deception by mimicking official Ledger branding and functionality.

Analysis of the domain reveals multiple indicators of malicious activity. The domain was registered on April 4, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, which is geolocated to Canada and associated with Cloudflare’s network. Security vendors have flagged the domain, with 10 out of 95 VirusTotal engines detecting it as malicious. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites leveraging Cloudflare’s hosting infrastructure.

As of the latest assessment, the domain remains active and continues to host the fraudulent Ledger Live download page. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for connections to 188.114.96.3 and inspect logs for any interactions with dev-home-live-download.pages.dev. End-users should be educated to verify the authenticity of download sources, particularly for cryptocurrency-related software, and to cross-reference official vendor communications before engaging with such pages.