academy-ledger[.]webflow[.]io

This domain, academy-ledger.webflow.io, has been confirmed as a brand impersonation site specifically targeting Ledger, a hardware cryptocurrency wallet provider. The site mimics official Ledger support pages, presenting itself as legitimate guidance for setting up a Nano X device. Current analysis indicates the domain is offline, though prior activity suggests it was operational for malicious purposes. Technical indicators reveal the domain was flagged by 17 of 95 security vendors on VirusTotal, a notably elevated detection rate for a recently created domain. Infrastructure analysis shows the domain was registered through Webflow, a platform commonly used for both legitimate and malicious sites. It resolved to the IP address 172.64.151.8, geolocated to Cloudflare infrastructure in Canada. The domain was created on April 01, 2026, an anomalous future date likely indicating falsified registration details. It appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The page title, 'Nano X - How to start using your device | Ledger,' directly mirrors official Ledger branding, increasing the likelihood of successful social engineering. Given the domain's current offline status, immediate risk to users is reduced, though historical activity warrants caution. Organizations and individuals should treat this domain as malicious and avoid any interaction. Recommended actions include blocking the domain and associated IP (172.64.151.8) at the network perimeter, updating endpoint protection rules to flag or quarantine any related artifacts, and monitoring for similar impersonation attempts targeting Ledger or other cryptocurrency brands. Users who may have visited this domain should verify device integrity, review transaction histories, and reset credentials for any associated accounts.