stax-ledger[.]live

On July 24, 2026, the domain stax-ledger.live was observed hosting a cryptocurrency‑related impersonation campaign targeting the Ledger brand. The site resolves to the IPv4 address 104.26.14.124, which belongs to AS13335 operated by Cloudflare, Inc., and the domain’s authoritative nameservers are carmelo.ns.cloudflare.com and martha.ns.cloudflare.com, both Cloudflare‑managed. The HTTP service returns a 200 OK status and the page title is exactly “stax-ledger.live”. No TLS certificate is presented, indicating that the site is served over plain HTTP only. VirusTotal records show that 15 of 95 scanned security vendors flagged the domain as malicious, and the domain appears on a single external blocklist.

Independent threat‑intelligence feeds, including PhishDestroy, have already blocked the domain. The registrar information confirms registration through Cloudflare, Inc., and the domain remains active at the time of analysis. The available data confirms a high‑risk, brand‑impersonation infrastructure that leverages Cloudflare’s network to obscure the true origin of the payload. While the content of the landing page has not been publicly disclosed, the classification as a “Crypto Scam” and the explicit impersonation of Ledger suggest that the site is likely used to harvest private keys, credentials, or to lure victims into fraudulent transactions.

Uncertainty remains regarding the specific phishing kit, any additional command‑and‑control endpoints, and whether the site employs redirection chains. Defenders should update URL filtering rules to block stax-ledger.live, enforce HTTPS‑only policies to prevent fallback to plain HTTP, and monitor for any outbound connections to the 104.26.14.124 address. Incident response teams should also advise Ledger users to verify URLs and avoid entering sensitive information on sites lacking a valid TLS certificate.