buy-ledger[.]webflow[.]io

This domain, buy-ledger.webflow.io, is flagged as a crypto scam impersonating Ledger, a hardware wallet provider. Analysis indicates the domain was created on May 8, 2013, though the phishing campaign appears recent, given its detection in July 2026. The page title, 'Ledger® Live* Wallet - & A Complete Guide to Ledger®,' directly references Ledger’s branding, reinforcing the impersonation attempt. The domain is currently offline, returning an HTTP 404 status, and has been taken down following detection by security vendors, including PhishDestroy.

It appears on one security blocklist, and 11 of 95 security vendors on VirusTotal flagged it as malicious. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, resolving to IP 104.18.36.248 in the US. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites. Scamadviser assigned a trust score of 1/100, classifying it as a crypto scam.

Defenders should treat this domain as a confirmed brand impersonation threat targeting Ledger users. Given its offline status, no active payload is present, but historical DNS and WHOIS records should be reviewed for additional indicators. If encountered in logs, this domain should be blocked at the network and endpoint levels. Further investigation into associated IPs, certificates, or registrant details may uncover related infrastructure.