ledger-live-start[.]app

Analysis of the domain ledger-live-start.app indicates active brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. As of July 19, 2026, the domain resolves to IP address 172.67.164.226, hosted behind Cloudflare infrastructure in Canada, with nameservers arushi.ns.cloudflare.com and louis.ns.cloudflare.com. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and presents an HTTP 403 Forbidden status, suggesting either restrictive access controls or a misconfigured phishing page. Infrastructure review confirms the domain is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is classified as a brand impersonation scam. Two of 91 security vendors on VirusTotal detect the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare. While the exact content of the site remains unconfirmed due to the 403 status, the domain name and known intelligence strongly suggest an intent to deceive users into believing they are interacting with Ledger’s official platform. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access. No evidence indicates the specific phishing kit or payload in use, and further analysis of the site’s active content is required to determine the exact attack vector.