ledger-liive--bownload[.]webflow[.]io

The domain ledger-liive--bownload.webflow.io was registered on March 03, 2026 and is hosted on Cloudflare infrastructure (AS13335) with the IP address 172.64.151.8 located in the United States. It resolves to a Webflow‑hosted site that serves content over HTTPS using a Google Trust Services / WE1 certificate and supports HTTP/3. The site returns HTTP 200 and advertises the page title "Ledger® Live*Download - Secure Crypto Wallet (Webflow) - us," explicitly targeting the Ledger brand and presenting itself as a download portal for a crypto wallet. The Gridinsoft trust score of 0/100 and the presence on a security blocklist (blocked by PhishDestroy) indicate a high likelihood of malicious intent. VirusTotal analysis shows that 20 of 94 security vendors flag the domain, reinforcing the assessment of a crypto‑related brand‑impersonation campaign. The infrastructure is typical of rapidly deployed phishing sites, leveraging legitimate cloud services to obscure origin. Current evidence does not reveal the exact payload or credential‑stealing mechanisms, and no visual or functional analysis of the page content is available. Defenders should immediately block the domain at network perimeter and DNS layers, add it to threat‑intel feeds, and monitor for any related subdomains or duplicate hosting patterns. Users should be warned not to download any files or enter credentials on sites claiming to be Ledger services, especially those using the "ledger‑liive" naming pattern. Continuous scanning of newly created Webflow sites for similar brand‑impersonation indicators is recommended to mitigate further exposure.