ledger-m--auth-info[.]webflow[.]io

This domain is flagged for elevated-risk brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The threat involves a fraudulent replica of the official Ledger.com/Start onboarding page, designed to harvest recovery phrases or credentials from unsuspecting users under the guise of account verification or device setup. Analysis indicates this is not a generic phishing attempt but a targeted crypto drainer precursor, given the specificity of the impersonated page and the high-value nature of the brand. Infrastructure analysis reveals the following technical indicators: the domain ledger-m--auth-info.webflow.io resolves to IP 172.64.151.8, hosted on Cloudflare infrastructure (AS13335) in the United States. The domain was originally created on May 08, 2013, though the subdomain appears to have been repurposed for malicious activity. It is currently offline but was previously detected by 17 out of 95 security vendors on VirusTotal, with listings on two blocklists (PhishDestroy and PhishingDB). The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. Registration details point to MarkMonitor, Inc., a registrar frequently abused for brand impersonation due to its association with high-profile domains. Mitigation steps for this specific threat type include immediate blacklisting of the domain and its resolving IP in network security controls. Organizations should monitor for residual DNS queries to 172.64.151.8 and alert users who may have interacted with the page prior to takedown. Given the crypto-focused nature of the impersonation, targeted user education should emphasize the risks of entering recovery phrases or private keys into any web interface, regardless of apparent legitimacy. Security teams should also review logs for connections to the domain or IP during the active window, as compromised credentials may still be exploited in follow-up attacks. Blocking subdomains under webflow.io with similar naming patterns (e.g., ledger-*, auth-*) may preemptively disrupt related campaigns.