app[.]ledger-live-web[.]io

app.ledger-live-web.io is a newly registered domain (created 16 April 2026) that has been identified as a brand‑impersonation site targeting Ledger. The domain resolves to the IPv4 address 193.24.123.182 and uses Cloudflare name servers finley.ns.cloudflare.com and rachel.ns.cloudflare.com, indicating that the hosting infrastructure is behind a CDN. Registration was performed through TLD Registrar Solutions Ltd., a registrar that does not provide additional public contact details. The domain is currently active and listed as under investigation. VirusTotal records show that the URL was submitted to 91 scanning engines, none of which returned a detection at the time of analysis; this absence of alerts does not constitute evidence of benign behavior. No publicly available content, page titles, or certificate details have been captured, so the exact appearance and functionality of the site remain unknown. Defenders should treat the domain as malicious until further evidence proves otherwise. Recommended actions include adding the domain to blocklists at the network perimeter, configuring DNS sink‑hole rules, and monitoring outbound traffic for connections to 193.24.123.182. Incident response teams should also query passive DNS and SSL transparency logs for any historical resolutions that might reveal additional infrastructure or related domains. Continuous re‑scanning of the URL on VirusTotal or similar platforms is advised to capture any future detections. Organizations that use Ledger products should alert users to the existence of this impersonation attempt and reinforce safe‑login practices.