guide-download-ledgre[.]pages[.]dev

The domain guide-download-ledgre.pages.dev was registered on April 8, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which is hosted in the Cloudflare network in Canada. The site presents a page title of "Ledger Live App® | Official Ledger Mobile & Desktop Application," indicating a direct attempt to impersonate Ledger’s official software offering. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming that the connection is encrypted but does not validate the legitimacy of the content. HTTP responses return a 403 status code, and the domain is currently taken offline, with the last known status recorded on July 25, 2026.

Security telemetry shows that two of ninety‑four VirusTotal scanners flagged the domain, and it appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, suggesting a high likelihood of malicious intent. Nameserver records point to alice.ns.cloudflare.com and reese.ns.cloudflare.com, consistent with the registrar information.

While the available data confirms the infrastructure and branding impersonation, the exact payload, phishing kit, or credential‑capture mechanisms remain unverified because the site is no longer reachable. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the same host or IP range, and update internal threat‑intel feeds with the observed indicators of compromise. Analysts are advised to correlate this domain with other Ledger‑related phishing attempts to identify potential campaign infrastructure reuse.