live[.]w-ledger[.]com

Analysis of live.w-ledger.com indicates a confirmed brand‑impersonation operation targeting Ledger users. The domain was registered on August 07, 2025 through Eranet International Limited and is hosted on the Icelandic network AS44925 (1984 ehf) at IP address 185.112.145.240. No TLS certificate is presented, leaving the site unencrypted and increasing the risk of credential interception. The page title returned from the live host, "Ledger Live App | Getting started Ledger," directly mirrors Ledger’s official product naming, reinforcing the impersonation intent.

VirusTotal scans show that two of ninety‑five security vendors flagged the domain, providing independent confirmation of malicious activity. The site is currently listed on at least one public blocklist and has been specifically blocked by PhishDestroy, demonstrating that threat‑intel feeds have already identified the infrastructure. Nameserver configuration includes ns0.1984.is, ns1.1984.is, ns1.1984hosting.com, ns2.1984.is, and ns2.1984hosting.com, all associated with the same Icelandic provider, suggesting a single‑operator hosting environment. The domain’s current status is offline, which may indicate takedown or temporary suspension; however, the underlying infrastructure remains observable and could be re‑activated.

Uncertainty remains regarding the full scope of the phishing campaign, such as the exact content served, the presence of credential‑harvesting forms, or any additional malicious payloads, because the site has not been publicly captured. Defenders should continue to block the IP 185.112.145.240 and the domain in DNS filtering solutions, monitor the associated nameservers for any re‑registration activity, and advise Ledger users to verify URLs and never disclose seed phrases to unsolicited sites. Ongoing surveillance of the registrar and hosting provider is recommended to detect potential re‑use of the same infrastructure for future impersonation attempts.