ledger-live-non-evm[.]stakek[.]it

This domain, ledger-live-non-evm.stakek.it, is identified as a brand impersonation threat targeting Ledger, a manufacturer of cryptocurrency hardware wallets. Analysis confirms the domain was designed to mimic legitimate Ledger Live software interfaces, specifically non-EVM (Ethereum Virtual Machine) wallet management portals. The current status of the domain is offline, though prior activity suggests it was actively used for credential harvesting and unauthorized transaction manipulation. Infrastructure analysis reveals the domain was registered through 1 Api GmbH on March 28, 2026, an unusual future date that may indicate domain registration manipulation or data obfuscation. It resolved to the IP address 66.33.60.34, a shared hosting endpoint with no prior association with Ledger’s official infrastructure. Security vendor assessments show 3 of 95 engines on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The SSL certificate was issued by Let’s Encrypt, a common but non-exclusive indicator of legitimacy. The page title, Yield.xyz, suggests an attempt to redirect victims toward fraudulent staking or yield farming platforms, a known vector for cryptocurrency theft. The risk level is classified as elevated due to the targeted nature of the impersonation and the potential for financial loss. While the domain is currently offline, organizations and individuals should treat any prior interaction with it as compromised. Immediate actions include revoking any credentials or recovery phrases entered on the site, monitoring wallet addresses for unauthorized transactions, and verifying all Ledger-related software downloads exclusively from the official ledger.com domain. Network administrators should block the domain and its associated IP (66.33.60.34) at the perimeter, and security teams should investigate logs for connections to this endpoint between March 2024 and the present.