official-ledgrlive[.]com

Analysis of the domain official-ledgrlive.com indicates high-risk infrastructure associated with a crypto scam impersonating Ledger, a hardware wallet provider. The domain was registered on September 29, 2025, through ERANET INTERNATIONAL LIMITED and is currently offline. Infrastructure analysis reveals it resolved to IP 162.215.253.186 (US, AS46606 Unified Layer) with nameservers ns1.md-18.webhostbox.net and ns2.md-18.webhostbox.net. No SSL certificate was detected, increasing the likelihood of unencrypted communications.

The domain appears on six security blocklists, including PhishDestroy, MetaMask, Polkadot, SEAL, and Enkrypt, which classify it as malicious. AlienVault OTX lists it in 16 threat intelligence pulses, further corroborating its association with phishing activity. While 18 of 93 security vendors on VirusTotal flagged the domain, the absence of additional context limits definitive conclusions about its payload or exact attack vector. The page title, 'Ledger Live App - Secure Crypto Management | Crypto Education Hub,' aligns with Ledger's branding, suggesting an intent to deceive users into believing the site is an official Ledger resource.

However, the exact content and functionality of the site remain unanalyzed due to its offline status. Defenders should treat this domain as part of a broader crypto scam campaign targeting Ledger users and block it at the network and endpoint levels. Monitoring for re-registration or re-emergence under similar domains is recommended, as threat actors frequently reuse infrastructure for follow-up attacks.