official-ledger-app[.]live

official-ledger-app.live is flagged as a brand‑impersonation site targeting users of the Ledger hardware‑wallet product. The domain was registered through Cloudflare, Inc., and its authoritative nameservers are dana.ns.cloudflare.com and seamus.ns.cloudflare.com. DNS resolution points to the IP address 104.21.79.199, which belongs to AS13335 owned by Cloudflare, Inc., and is geolocated in the United States. No SSL certificate is associated with the host, and an HTTP request returns a 520 Web server error, indicating an unknown condition on the origin server. The page title observed during analysis reads “official-ledger-app.live | 520: Web server is returning an unknown error”, confirming the error response without revealing page content.

Threat intelligence sources show the domain appearing in fifteen AlienVault OTX pulses and being listed on two public blocklists, specifically PhishDestroy and CryptoFirewall. VirusTotal scans have resulted in eleven of ninety‑five security vendors flagging the domain as malicious. The Gridinsoft trust score is recorded as 0 out of 100, reflecting a lack of trust. The infrastructure is associated with an “Airdrop Scam” phishing kit, a pattern commonly used to lure cryptocurrency users with false token distribution offers. The domain is currently taken offline, yet historical data indicate that it was actively used for crypto‑related social engineering.

Defenders should continue to block the domain at network perimeter and update endpoint protection rules to include the observed IP address and ASN. Monitoring for newly registered subdomains under the same Cloudflare account is advisable, given the ease of provisioning additional aliases. Because the site lacks TLS, any attempts to reach it will generate clear‑text network traffic that can be inspected.