lagherlviapp[.]webflow[.]io

The domain lagherlviapp.webflow.io is identified as a brand impersonation threat specifically targeting Ledger, a provider of cryptocurrency hardware wallets. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent login page titled 'Ledger&^ Live* : Login | Most Secure Crypto Wallet - Us.' This infrastructure was designed to deceive users into submitting credentials or sensitive information under the guise of a legitimate Ledger service interface.

Infrastructure analysis reveals the domain was flagged by 19 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious intent. It resolved to the IP address 172.64.151.8, hosted under Cloudflare, Inc. (AS13335) in the United States. The SSL certificate was issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. The domain was registered through MarkMonitor, Inc., though the creation date listed as March 05, 2026, suggests potential falsification or misconfiguration. It appears on at least one security blocklist, further corroborating its malicious classification.

Given the domain’s current offline status, immediate risk to end users is reduced. However, the infrastructure may resurface under a different domain or hosting provider. Users who interacted with this domain should assume credential compromise and take immediate action: revoke any active sessions, reset passwords, and enable multi-factor authentication on all related accounts. Organizations should monitor for similar impersonation attempts, particularly those leveraging Cloudflare-hosted subdomains or mimicking cryptocurrency wallet interfaces. Security teams are advised to block the domain and associated IP address in perimeter defenses to prevent future access attempts.