ledgerliveapp[.]webrpc[.]network

ledgerliveapp.webrpc.network was registered on February 21, 2026 and resolves to the IPv4 address 151.106.96.72, which is assigned to AS47583 Hostinger International Limited in the United States. The domain is hosted on Hostinger’s infrastructure and uses the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. No TLS certificate is presented, indicating that the site is served only over HTTP. The only visible page element is a title tag reading "Ledger", which aligns with the declared brand target of Ledger and the classification of a crypto‑related scam.

VirusTotal scans have recorded ten detections out of ninety‑three antivirus engines, and the domain is listed on at least one public security blocklist. It has also been flagged by the PhishDestroy blocklist. The site was identified as a "Crypto Scam" in the intelligence feed and is currently marked as offline. The available evidence confirms that the domain is being used to impersonate the Ledger brand, likely to lure cryptocurrency users, but the exact payload or phishing page content has not been captured.

Uncertainty remains regarding the specific malicious functionality, such as credential harvesting or malware delivery, because no page content beyond the title has been retrieved. Defenders should continue to block the domain and its hosting IP, monitor for any re‑registration attempts, and incorporate the observed indicators—domain name, hosting ASN, IP address, lack of SSL, and the ten VirusTotal detections—into threat‑intel feeds and intrusion‑prevention rules. Ongoing observation of related subdomains under the webrpc.network zone is recommended, as the same infrastructure could be leveraged for additional impersonation campaigns.