backup[.]manage-ledger[.]live

The domain backup.manage-ledger.live was registered on February 21, 2026 and is currently flagged as an active brand‑impersonation campaign targeting the Ledger brand. It resolves to the IP address 172.67.132.235, which is assigned to AS13335 Cloudflare, Inc. in the United States and serves HTTP status 200 over an SSL certificate identified as WE1. The page title returned by the server is "Ledger," confirming the explicit reference to the targeted brand.

Infrastructure analysis shows the domain is delegated to the nameservers ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended-. The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal scanning reports that 12 of 95 security vendors have flagged the domain as malicious, indicating a moderate level of consensus among scanners.

The observable indicators point to a cryptocurrency‑related scam, as the intelligence labels the scam type as "cryptocurrency" and the brand target as Ledger. The page title and brand impersonation suggest the site is likely used to lure victims into disclosing wallet credentials or to initiate fraudulent transactions. No direct content analysis is available, so the exact tactics employed on the landing page remain uncertain.

Defenders should prioritize blocking backup.manage-ledger.live at the DNS and proxy layers, monitor for any changes to its name‑server configuration, and consider adding the associated IP address to network‑wide blocklists. Continuous scanning of the domain with updated VirusTotal or similar services is advised, as well as user awareness campaigns warning that unsolicited communications referencing Ledger may originate from this malicious infrastructure.