help-ledgerlive-io[.]fly[.]dev

The domain help-ledgerlive-io.fly.dev is currently active and has been identified as a high-risk threat for brand impersonation, specifically targeting the cryptocurrency hardware wallet brand Ledger. The domain does not utilize an SSL certificate, which is a red flag for security-conscious users. The threat type is primarily credential theft, aiming to deceive users into divulging sensitive information such as login credentials and personal data.

Technical analysis reveals that the domain is registered through MarkMonitor, Inc. and resolves to the IP address 66.241.124.119, which is located in the United States and is part of the AS40509 network, operated by Fly.io, Inc. The domain was created on March 01, 2019. On VirusTotal, 9 out of 95 security vendors flag this domain as malicious. The domain appears on 1 security blocklist and is blocked by PhishDestroy, a known security tool. The Google Safe Browsing (GSB) status indicates the domain is still active and not yet flagged as dangerous by the service.

The current status of help-ledgerlive-io.fly.dev is active, posing a significant risk to users who may be misled by its official appearance. Response actions should include reporting the domain to relevant authorities and security platforms, as well as educating users about the importance of verifying URLs and SSL certificates. Despite being blocked by PhishDestroy, the domain remains a threat due to its continued activity and the potential for further distribution through unsecured channels. Users are advised to avoid interacting with this domain and to report any suspicious activity to their security teams.