login-ledger[.]live

This domain, login-ledger.live, is currently active and hosts a crypto‑scam page that claims to be associated with Ledger. The site is registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are dana.ns.cloudflare.com and seamus.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented; the site serves HTTP only and returns a 200 OK status for the root request. The HTML title returned by the server is “Ledger Live - Download | Getting Started Ledger App™”, matching the brand target Ledger and reinforcing the impersonation claim.

VirusTotal has recorded ten detections out of ninety‑five scanners, confirming that multiple security vendors have flagged the domain as malicious. The domain also appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service. These indicators collectively suggest that the infrastructure is being leveraged for credential harvesting or cryptocurrency‑related fraud, consistent with the “Crypto Scam” classification in the intelligence feed. While the page content has not been publicly disclosed, the combination of brand‑targeted page title, lack of HTTPS, and the presence of detections indicates a high likelihood of malicious intent.

Uncertainty remains regarding the exact payload delivered to victims, the duration of the campaign, and any additional command‑and‑control infrastructure that may be associated with the same IP address. Defenders should add login-ledger.live to blocklists at the DNS and proxy layers, monitor outbound traffic for connections to 188.114.96.3, and enforce strict TLS inspection policies to prevent users from accessing the site over plain HTTP.