ledger-live-io[.]com

Analysis of ledger-live-io.com, registered on 21 February 2026 through NiceNIC International Group Co., Limited, shows infrastructure consistent with a brand‑impersonation campaign targeting Ledger users. The domain resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. Both authoritative nameservers are Cloudflare‑managed (gabriella.ns.cloudflare.com, robert.ns.cloudflare.com), and the site was served over HTTP/3 using a certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain but not a guarantee of legitimacy. A connection attempt returned a 522 timeout, and the page title reported “ledger-live-io.com | 522: Connection timed out”, confirming the site is currently offline.

Threat intelligence flags the domain as a crypto‑related scam that impersonates Ledger, the hardware‑wallet provider. VirusTotal scans show three of ninety‑three AV engines flag the domain, and the domain appears on one external blocklist. PhishDestroy has already added it to its blocklist, reinforcing the elevated risk assessment. No additional public reports or sandbox analyses are available, so the exact payload or phishing page content remains unknown.

Defenders should block any outbound connections to 188.114.97.3 and add ledger-live-io.com to URL filtering policies. Monitoring for similar domains registered with the same registrar or using the same Cloudflare nameservers may reveal related infrastructure. Because the TLS certificate is legitimate, reliance on certificate validation alone is insufficient; correlation with brand‑impersonation indicators such as the domain name and the reported scam type should drive detection rules. Continuous re‑scanning with multi‑engine services is recommended to capture any future changes in the domain’s behavior.