ledger[.]live-official[.]live

This domain, ledger.live-official.live, is identified as a brand impersonation threat specifically targeting Ledger, a cryptocurrency hardware wallet provider. The domain is currently offline, though prior analysis confirms its malicious intent to deceive users into believing they are interacting with legitimate Ledger services. The threat type aligns with credential theft and potential crypto asset compromise, given the targeted brand's association with digital asset security. Analysis indicates the domain was flagged by 9 of 95 security vendors on VirusTotal, a notably high detection rate for a recently registered domain. It was registered through NiceNIC International Group Co., Limited, and its infrastructure resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). The domain was created on February 21, 2026, an unusually future date that may indicate an attempt to evade detection or sandboxing. It appears on one security blocklist and uses an SSL certificate issued by Google Trust Services (WE1), which, while not inherently malicious, is often leveraged by threat actors to lend false legitimacy. The page title, 'Nur einen Moment…,' suggests a transient or cloaked landing page designed to delay or mislead users during interaction. The domain’s current offline status reduces immediate risk, but its prior infrastructure and detection metrics warrant continued monitoring. Organizations and individuals should block this domain at the network level and scrutinize any historical logs for connections to 188.114.97.3. Users of Ledger products are advised to verify domain authenticity by cross-referencing official communications and avoiding unsolicited links. Security teams should treat domains registered through NiceNIC with heightened scrutiny, particularly those impersonating cryptocurrency services, due to recurring patterns of abuse in this registrar’s namespace.