www-ledgar-live[.]app

This domain, www-ledgar-live.app, is actively engaged in a phishing campaign designed to harvest user credentials through a fake login portal. Analysis indicates the site presents an "Access Restricted" page, a common tactic to lure victims into entering sensitive information under false pretenses. The domain remains operational and poses a high risk to unsuspecting users, particularly those targeted by credential theft schemes. Infrastructure analysis reveals the domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.66.81, which hosts additional suspicious content. Detection metrics show the domain is flagged by 1 of 95 security vendors on VirusTotal, a notably low detection rate that may indicate evasion techniques or recent deployment. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while failing to mitigate the underlying threat. No additional blocklist entries or trust scores were identified at the time of analysis. The domain remains active, and users are advised to exercise extreme caution. Organizations should implement network-level blocking for 104.21.66.81 and the domain www-ledgar-live.app to prevent access. End-users encountering this domain should avoid interacting with any login prompts or input fields. Security teams are encouraged to monitor for further detections, as the low initial flagging rate suggests the campaign may still be in its early stages of propagation.