ledgerlive[.]com[.]es

The domain ledgerlive.com.es was registered on May 27, 2026 and currently resolves to the Cloudflare‑hosted address 172.67.69.181 located in Canada. HTTP requests receive a 200 response and the site presents the page title “Ledger Live · Descargar Ledger Live para Windows,” indicating a direct attempt to mimic the official Ledger Live download page. The TLS certificate is issued by TrustAsia Technologies, Inc. under the TrustAsia DV TLS RSA CA 2025, which is typical for Cloudflare‑protected sites but does not authenticate the underlying brand. Security intelligence shows that two of ninety‑one VirusTotal scanners flag the domain, and it appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score of 0 / 100 further reflects a low reputation. While the infrastructure points to a standard Cloudflare front‑end, the combination of a brand‑specific page title, low trust scores, and partial VirusTotal detections suggests a high‑risk brand‑impersonation campaign targeting Ledger users. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP, and update filtering rules to include the observed hostnames. Additional investigation of the content served at the URL is recommended to confirm malicious payloads or credential‑harvesting mechanisms, as the current evidence does not reveal the exact malicious behavior beyond the impersonation cue.