v-2-ledger[.]live

The domain v-2-ledger.live was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on 17 September 2025. DNS resolution points to the IP address 104.26.10.117, which belongs to Cloudflare, Inc. (AS13335) and is geographically located in the United States. The site currently returns an HTTP 520 error with the page title “v-2-ledger.live | 520: Web server is returning an unknown error”, indicating that the web service is unavailable or deliberately taken offline. Threat intelligence flags the domain as a crypto‑related brand impersonation of Ledger. VirusTotal analysis shows that 14 of 93 scanning engines flagged the domain as malicious, and AlienVault OTX lists the domain in one threat‑intel pulse.

The domain is listed on a security blocklist and has been blocked by PhishDestroy. Additional reputation data includes a Gridinsoft trust score of 0 / 100 and a SSL certificate labeled “WE1”. These indicators collectively suggest that the domain was used to lure victims into a Ledger‑related crypto scam, although the exact payload or phishing page content cannot be confirmed because the site is offline. Uncertainty remains regarding the specific malicious content that was hosted before the takedown, as the 520 response prevents direct inspection of the landing page, login form, or any embedded malware.

No further forensic artifacts such as URLs, email templates, or wallet addresses have been released publicly. Defenders should continue to block the IP 104.26.10.117 at the perimeter, add v-2-ledger.live to URL filtering and endpoint deny lists, and monitor for newly registered domains that reuse the “ledger” keyword or similar Cloudflare‑hosted infrastructure. Ongoing correlation with the 14 VirusTotal detections and the OTX pulse can help identify related campaigns. Because the registrar is known, investigators may consider requesting registration records to trace any downstream infrastructure or payment accounts linked to the domain.