app-ledgerlive--official[.]webflow[.]io

This domain, app-ledgerlive--official.webflow.io, is confirmed to engage in brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The site mimics the official Ledger Live application interface, likely to deceive users into entering sensitive credentials or installing malicious software under the guise of legitimate crypto security tools. Such impersonation poses a direct risk of credential theft, unauthorized access to crypto wallets, and potential financial loss for victims who believe they are interacting with a trusted platform. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain was registered on March 03, 2026, through Webflow, a platform often exploited for hosting phishing content due to its ease of deployment. It resolves to the IP address 104.18.36.248, associated with Cloudflare (AS13335), which is frequently used to obscure hosting origins. VirusTotal reports that 20 out of 95 security vendors flag this domain as malicious, and it appears on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while failing to validate the site's legitimacy. Users who visited app-ledgerlive--official.webflow.io should take immediate action to mitigate potential risks. Any credentials or recovery phrases entered on the site must be considered compromised and should be revoked or changed immediately from a secure device. Affected users should also scan their systems for malware, particularly crypto-draining scripts or keyloggers that may have been installed. It is recommended to monitor crypto wallet transactions for unauthorized activity and enable multi-factor authentication on all related accounts. If financial loss is suspected, report the incident to relevant authorities and the targeted brand for further investigation.