ledger-live[.]com[.]es

The domain ledger-live.com.es was registered on 2026-05-08 and immediately began serving a TLS certificate issued by TrustAsia Technologies, Inc. under the TrustAsia DV TLS RSA CA 2025. The certificate chains to a trusted root, but the domain name is a clear derivative of the legitimate Ledger brand, indicating intentional brand impersonation. DNS resolution points to the single IPv4 address 43.174.246.23, which is geolocated to Singapore (ACE). HTTP requests to the host return a 403 status, suggesting that the front‑end is deliberately restricting access, a pattern commonly observed in credential‑harvesting sites that hide their payload behind authentication checks.

VirusTotal has recorded 2 detections out of 95 scanned security vendors, confirming that at least two scanners have identified malicious characteristics. The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reflecting consensus among multiple threat‑intelligence providers. Gridinsoft assigns a trust score of 0 out of 100, and AlienVault OTX references the domain in a single pulse, reinforcing its classification as a high‑risk actor. The active status and presence of a valid TLS certificate enable the infrastructure to masquerade as a legitimate service while delivering the impersonation payload.

Defenders should add ledger-live.com.es to network and DNS deny lists, and enforce TLS inspection to capture any encrypted traffic directed to the address 43.174.246.23. Monitoring for HTTP 403 responses from this host can aid in early detection of attempts to reach the impersonation page. Security operations should also update endpoint protection signatures to reflect the observed VirusTotal detections and the low Gridinsoft trust score. Continuous enrichment of internal threat intel with the AlienVault pulse will help maintain awareness of any future infrastructure changes associated with this campaign.