s-ledger[.]live

Analysis of the domain s-ledger.live indicates a targeted brand impersonation campaign against Ledger, a hardware wallet provider. The domain was registered through Cloudflare, Inc. and resolved to the IP address 104.21.2.35, associated with AS13335 Cloudflare, Inc. in the United States. No SSL certificate was detected, which is atypical for legitimate financial or cryptocurrency services and increases the risk of credential interception. The domain is currently offline, but prior to takedown, its page title explicitly mimicked Ledger’s official branding: 'Ledger Live: Official App for Your Ledger Wallet & Download,' suggesting an intent to deceive users into downloading malicious software or disclosing wallet recovery phrases. Infrastructure analysis reveals the use of Cloudflare nameservers (dana.ns.cloudflare.com and seamus.ns.cloudflare.com), a common tactic to obscure hosting origins and evade detection.

The domain appears on one security blocklist, PhishDestroy, and was flagged by 12 of 95 security vendors in a VirusTotal scan, confirming its malicious classification. The scam type is identified as wallet/seed phishing, a method used to compromise cryptocurrency wallets by tricking users into entering sensitive information. While the exact content of the site remains unanalyzed, the combination of impersonation, lack of SSL, and detection by multiple vendors provides strong evidence of fraudulent intent. Defenders should treat this domain as a confirmed threat.

Blocklist the domain and IP address 104.21.2.35 at perimeter security controls. Monitor for related domains using similar naming conventions (e.g., 'ledger-live' or 's-ledger' variants) and Cloudflare-hosted infrastructure. Given the offline status, further forensic analysis may be limited, but historical DNS records and WHOIS data could reveal additional indicators of compromise.