ledger--livestart[.]webflow[.]io

This domain is flagged as an elevated-risk brand impersonation site specifically designed to deceive users of the Ledger hardware wallet platform. Analysis indicates the infrastructure was crafted to mimic the official Ledger onboarding process, likely serving as a vector for crypto asset theft through fake wallet initialization or credential harvesting. The threat type aligns with known patterns of cryptocurrency drainer schemes, where victims are tricked into connecting wallets to malicious smart contracts or revealing recovery phrases. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain ledger--livestart.webflow.io was registered through MarkMonitor, Inc., a legitimate registrar often abused for lookalike domains, and resolved to IP address 104.18.36.248 (AS13335 Cloudflare, Inc.). Security vendors on VirusTotal detected the domain at a rate of 19/95, with PhishDestroy and one additional blocklist confirming malicious activity. The SSL certificate, issued by Google Trust Services (WE1), follows the pattern of adversaries leveraging trusted certificate authorities to lend false legitimacy. Notably, the domain creation date of March 06, 2026, is anomalous, suggesting either a typo-squatting attempt or an error in registration metadata. The page title, Ledger.com/Start® - Official Site® | Getting started, directly impersonates Ledger’s official branding, including fraudulent trademark symbols to enhance perceived authenticity. Mitigation requires immediate action from both end users and infrastructure providers. Users who interacted with this domain should assume compromise of any wallet credentials or recovery phrases entered, necessitating the transfer of assets to a new wallet and revocation of connected dApp permissions. Ledger administrators should issue a public advisory warning users of the impersonation attempt and monitor for similar domains registered through MarkMonitor or other enterprise-grade registrars. Network defenders should block the domain and associated IP (104.18.36.248) at the perimeter, while certificate authorities should investigate the issuance of SSL certificates to lookalike domains. Given the elevated risk of crypto asset loss, affected users should also report the incident to relevant financial crime authorities for tracking of stolen funds.