my-ledger-liive-login[.]webflow[.]io

This domain, my-ledger-liive-login.webflow.io, is flagged as an active brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live login interface, designed to harvest user credentials and potentially facilitate unauthorized access to crypto wallets. The threat type aligns with credential phishing, leveraging visual and functional deception to exploit trust in the Ledger brand. No explicit drainer kit signatures were detected in initial scans, though the infrastructure supports rapid deployment of malicious scripts if not already present. Infrastructure analysis reveals the domain resolves to IP address 104.18.36.248, geolocated to Cloudflare, Inc. in Canada, a common proxy service used to obfuscate hosting origins. The domain is registered through Webflow, a legitimate website builder platform often abused for phishing due to its ease of use and SSL provisioning. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious, a moderate but concerning consensus. The SSL certificate, issued by Google Trust Services (WE1), further mimics legitimacy while the domain appears on at least one security blocklist. No creation date is available in the provided data, but the active phishing page suggests recent deployment. Current status of the domain remains active, with the phishing page fully operational at the time of assessment. The elevated risk level is justified by the combination of brand impersonation, credential theft potential, and the use of Cloudflare to evade takedowns. Immediate response actions should include reporting the domain to Webflow for suspension, notifying Ledger’s security team for brand protection measures, and updating blocklists to prevent user exposure. Users are advised to verify domain authenticity by cross-referencing with official Ledger communications and avoiding any login attempts on non-Ledger domains. The remaining risk persists until the domain is fully neutralized, as the infrastructure allows for rapid redeployment even after partial mitigation.