legr-live-cdn[.]pages[.]dev

The domain legr-live-cdn.pages.dev is currently active and engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. This infrastructure presents itself as the official Ledger Live desktop application, aiming to deceive users into downloading malicious software under the guise of secure crypto management tools. The page title, 'Download Ledger Live Desktop App for Secure Crypto Management,' directly mimics legitimate Ledger branding to enhance credibility. Analysis of technical indicators reveals the domain was registered on April 04, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare’s network. As of the latest assessment, the domain is flagged by 5 of 95 security vendors on VirusTotal, with one confirmed appearance on a security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend an air of legitimacy to phishing infrastructure. The domain remains unblocked by most major security providers, increasing its potential reach. Current infrastructure analysis indicates this domain remains operational and poses a high risk to users seeking Ledger software. The combination of brand impersonation, low detection rates, and Cloudflare hosting suggests a calculated effort to evade automated defenses. Users are strongly advised to verify domain authenticity by cross-referencing official Ledger communications and avoiding downloads from untrusted sources. Organizations should update blocklists to include this domain and monitor for related infrastructure patterns, such as similar subdomains or IP associations. Immediate reporting to relevant security teams is recommended to mitigate potential compromise of cryptocurrency assets.