lledger-app[.]webflow[.]io

This domain, lledger-app.webflow.io, is flagged as a brand impersonation threat targeting Ledger, a hardware wallet provider. Analysis indicates the site mimics the official Ledger Live application interface, likely designed to harvest user credentials or private keys under the guise of a secure web3 platform. The page title explicitly references Ledger Live, reinforcing the deception. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft campaigns targeting cryptocurrency users.

Technical indicators confirm elevated risk. The domain resolves to IP 104.18.36.248, hosted on Cloudflare infrastructure (AS13335). It was registered on February 21, 2026, through NameCheap, Inc., and holds an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports 14 out of 95 security vendors flagging the domain, while it appears on one security blocklist. The domain was not detected by Google Safe Browsing at the time of analysis, suggesting either recent deployment or evasion tactics.

Current status indicates the domain has been taken offline, likely following detection and reporting. However, residual risk persists due to the potential for infrastructure reuse or migration to new domains. Users who interacted with the site should revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP, while Ledger users should verify application authenticity through official channels only.