mail[.]ledgerlive[.]info

The domain mail.ledgerlive.info was registered on October 14, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and uses the authoritative nameservers a.dnspod.com and c.dnspod.com. Infra‑level analysis shows the domain resolves to the IP address 45.82.82.240, which is attributed to the Russian Autonomous System AS9123 operated by JSC TIMEWEB. No TLS certificate was observed for the site, indicating that any traffic to the domain would be unencrypted HTTP. The page title returned from the server reads "Website 86.54.24.145 is ready.

The content is to be added", suggesting a placeholder page rather than a fully deployed credential‑harvesting front‑end. The domain is currently marked as offline, yet it remains listed on at least one public security blocklist and has been actively blocked by the PhishDestroy service. A Gridinsoft trust score of 0 / 100 further reflects the malicious classification. VirusTotal scans identified the domain as suspicious in 14 of 95 security‑vendor engines, reinforcing the risk assessment.

The threat is categorized as a crypto‑scam that impersonates the Ledger brand, confirming a targeted attempt to deceive users of Ledger’s hardware wallet ecosystem. Defenders should continue to block the domain at network perimeters, enforce DNS filtering of the associated IP range, and monitor for any resurgence of the host under alternative subdomains. Given the absence of SSL and the placeholder page content, any attempted interaction would yield limited functional impact, but the presence of the domain on blocklists and vendor detections warrants elevated alert status and ongoing surveillance.