ledgelive[.]us[.]com

The domain ledgelive.us.com has been identified as a high‑risk brand‑impersonation site targeting Ledger users. Infrastructure analysis shows the domain was registered on February 21, 2026 and resolves to the IP address 54.153.56.183, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site presents an SSL certificate classified as R12, indicating a low‑trust certificate issuance. VirusTotal reports that ten of ninety‑five security vendors flagged the domain as malicious, and the domain appears on three external blocklists.

Additional defensive platforms, including PhishDestroy, MetaMask, and SEAL, have already blocked the domain. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the assessment of severe risk. The HTTP response currently returns a status of offline, suggesting that the site has been taken down, but the underlying infrastructure remains observable. The page title returned from the server is "US.COM | The Premium Global Domain for the U.S. Market," which does not reference Ledger and may be intended to obscure the malicious intent.

While the exact content of the site has not been captured, the combination of brand‑impersonation labeling, registrar data, hosting on a major cloud provider, low‑trust SSL, multiple vendor detections, and blocklist listings provides concrete evidence of a targeted impersonation campaign. Defenders should immediately add ledgelive.us.com to domain blocklists, deny traffic to its associated IP address, and monitor for any related subdomains or newly registered variations that mimic Ledger branding. Continuous observation of the AS16509 address space is advised, as the same hosting environment may be reused for future impersonation attempts.