ledgerlive-start[.]webflow[.]io

The domain ledgerlive-start.webflow.io was registered through NameCheap on 21 February 2026. Its DNS is served by Cloudflare (journey.ns.cloudflare.com and lamar.ns.cloudflare.com) and resolves to IP 104.18.36.248, which belongs to Cloudflare’s AS13335 network located in the United States. The site is built on the Webflow platform and presents an SSL certificate issued by Google Trust Services (WE1), indicating a valid TLS handshake. HTTP requests return a 404 status, and the page title displayed by the server reads “Ledger.com/Start® | Official Webflow for Ledger Support”, explicitly referencing the Ledger brand and suggesting a credential‑collection front for that cryptocurrency hardware wallet provider. VirusTotal records show that 14 of 93 scanning engines flag the domain as malicious, and the domain is listed on at least one public blocklist used by PhishDestroy, which has already taken the site offline.

The Gridinsoft trust score of 0 / 100 further corroborates the low reputation. The combination of brand impersonation language, the “Crypto Scam” classification, and the presence of the Ledger trademark points to a typical credential‑harvesting operation targeting Ledger users. Defenders should treat the domain as hostile. Network defenders can block the domain at DNS or proxy layers, and security appliances that rely on reputation feeds should continue to flag it. Because the site is hosted behind Cloudflare, the underlying hosting provider may be shared with legitimate services, so blocking should be scoped to the specific hostname.

Email filters should watch for messages that reference “Ledger” or the “Start” sub‑page, as attackers often pair malicious domains with phishing emails. Analysts should monitor for any re‑registration of similar Webflow‑based subdomains or for new certificates issued for Ledger‑related subject names, as the actors may attempt to re‑host the campaign after takedown.