en---lldgerlive-auth[.]webflow[.]io

The domain en-ll-dgerlive-auth.webflow.io is identified as a brand impersonation threat targeting the cryptocurrency wallet brand Ledger. Analysis indicates that the domain does not employ any known drainer kits but is designed to deceive users into believing it is an official Ledger site, potentially leading to credential theft or financial loss.

Technical indicators for the domain include a VirusTotal score of 19/95, indicating that 19 out of 95 security vendors flag this domain as malicious. The domain is registered through Webflow and resolves to the IP address 104.18.36.248, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on March 12, 2026, and is currently listed on one security blocklist. The page title is 'Ledger® Live* : wallet**| Most Secure Crypto Wallet (webflow)', further reinforcing the impersonation.

The domain is currently offline, and response actions have been taken to mitigate the threat. Despite the offline status, the domain remains on one security blocklist, indicating a potential residual risk. Users are advised to remain vigilant and avoid clicking on any links or entering sensitive information on any sites that appear to impersonate Ledger or other trusted brands.