en-download-ledger-info[.]pages[.]dev

Analysis of the domain en-download-ledger-info.pages.dev indicates a fraudulent infrastructure impersonating Ledger, a hardware cryptocurrency wallet provider. The domain, registered on March 22, 2026, through Cloudflare, Inc., was taken offline following detection as a crypto scam. Infrastructure analysis reveals it resolved to the IP address 172.66.45.38, hosted by Cloudflare in Canada, and utilized Cloudflare nameservers (brenna.ns.cloudflare.com and junade.ns.cloudflare.com). The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare’s standard deployment but does not validate the site’s legitimacy. The page title, 'Ledger® Live | Download,' directly mimics Ledger’s official software, suggesting intent to deceive users into downloading malicious software.

Security vendor detections confirm elevated risk: ten of ninety-four engines on VirusTotal flagged the domain, and it appears on one security blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. The domain’s HTTP status returned a 403 Forbidden response at the time of assessment, indicating it was either blocked or disabled. Technologies detected include HSTS and HTTP/3, common in modern web deployments but not exclusive to legitimate services.

While the exact content of the site remains unanalyzed, the combination of brand impersonation, crypto scam classification, and detection by multiple security vendors provides concrete evidence of malicious intent. Defenders should treat this domain as compromised and block it at the network level. Organizations using Ledger products should alert users to verify download sources via official channels only. Given the domain’s offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential investigations.