leggers-live[.]us[.]com

This report examines leggers-live.us.com as of July 19, 2026, highlighting its role in high-risk brand impersonation targeting Ledger, a well-known cryptocurrency hardware wallet provider. The domain is currently active and presents a page titled 'Official Ledger Live Download | Secure Crypto Management,' which directly aligns with the impersonated brand. Infrastructure analysis shows that the domain resolves to IP address 104.21.73.36, associated with Cloudflare, Inc. in Canada, and uses nameservers ns1.centralnic.net through ns4.centralnic.net. The SSL certificate is issued by Google Trust Services (WE1), which provides a valid HTTPS connection but does not verify legitimacy.

Threat intelligence indicates that this domain is listed on three security blocklists and is currently blocked by security solutions including PhishDestroy, MetaMask, and SEAL. VirusTotal detection confirms four out of ninety-one vendors flagging this domain for malicious activity. The domain was registered through Instra Corporation Pty Ltd. The HTTP status code 200 confirms the site is operational.

The presence of specific brand references in both the page title and brand target fields, combined with blocklist evidence and security vendor detections, substantiates the domain's use for phishing, specifically through Ledger impersonation. The risk level is assessed as high due to ongoing activity and multi-vendor detection. Defenders are advised to block this domain at both network and endpoint levels, update security controls to recognize the IP and certificate as IoCs, and notify affected stakeholders. Further analysis of payloads or user impact is pending; however, all available evidence supports immediate mitigation actions. Uncertainties remain regarding the full extent of the campaign and associated infrastructure.