ledger-live--wallet[.]codedesign[.]app

The domain ledger-live--wallet.codedesign.app is currently classified as a high‑risk brand‑impersonation campaign targeting the Ledger brand. The site presents itself as a cryptocurrency‑related service, consistent with the reported scam type, and is marked as active as of the 12 July 2026 reporting date. No visual analysis of the page content is available; the assessment relies solely on observed infrastructure and registry data. Infrastructure analysis reveals that the domain resolves to the IPv4 address 34.29.29.250, which is announced by ASN 396982 and is registered to Google LLC in the United States. The registration was performed through the GOOGL‑2 registrar. The site serves an SSL certificate issued by Let’s Encrypt (certificate identifier E7), indicating the use of a freely‑issued TLS certificate. A Gridinsoft trust score of 0 / 100 further underscores the malicious nature of the host. Detection telemetry shows the domain appears on a single security blocklist and has been flagged by one of ninety‑five VirusTotal scanners, reflecting limited but concrete vendor awareness. The endpoint returns HTTP 200 responses, suggesting a functional web service. Enumerated technologies include Skolengo, MariaDB, Java, Node.js, Apache Tomcat, Nginx, React, and Stripe, indicating a modern stack capable of handling user interactions and payment processing. The site has been blocked by PhishDestroy, confirming its recognition by specialized anti‑phishing services. Defenders should prioritize immediate containment of the domain and the associated IP address. Network‑level blocks at firewalls, DNS sinks, and proxy filters are recommended, as is the inclusion of the domain in threat‑intelligence feeds used by endpoint protection platforms. Monitoring for additional domains sharing the same registrar or ASN may reveal further campaign infrastructure. End‑user education should stress that any unsolicited requests referencing Ledger services from this domain are fraudulent.