ledgerlivestatus[.]com

The domain ledgerlivestatus.com was registered on January 20, 2026 through CNOBIN INFORMATION TECHNOLOGY LIMITED. Since its creation, the site has returned an HTTP 403 status and presents a page title of “Just a moment…”. The content is associated with a cryptocurrency‑related brand impersonation campaign targeting Ledger users, indicating a high‑risk profile. Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which is hosted by Cloudflare, Inc. in Canada. Authoritative name servers are ivy.ns.cloudflare.com and newt.ns.cloudflare.com, confirming Cloudflare DNS usage. The TLS certificate is issued by Google Trust Services under the WE1 identifier, providing a valid HTTPS endpoint. Detected server technologies include Hostinger hosting, Cloudflare edge services, and HTTP/3 support. Threat intelligence flags ledgerlivestatus.com as a brand‑impersonation site. The Scamadviser trust score is 1 out of 100, and Gridinsoft assigns a zero rating, reflecting extreme maliciousness. The domain appears on two security blocklists and is recorded by blocklist providers. Security‑vendor scans have flagged the site in 17 of 95 checks, reinforcing the malicious classification. The site’s page title and HTTP 403 response are consistent with typical phishing landing pages that employ Cloudflare challenge pages to deter automated analysis. Current gaps include the lack of publicly disclosed payload samples and the specific phishing kit used, which remain undetermined. Defenders should block any outbound connections to ledgerlivestatus.com, add the domain to internal blacklists, and monitor DNS queries for the associated Cloudflare name servers. Users of Ledger products should be warned against entering credentials on sites presenting similar “Just a moment…” pages, and incident response teams should treat any credential submissions as compromised.