legr[.]d2cyaif9hhwrvy[.]amplifyapp[.]com

On July 23 2026 the domain legr.d2cyaif9hhwrvy.amplifyapp.com was identified as a high‑risk impersonation of Ledger. The site resolves to the IPv4 address 3.175.227.82, which belongs to Amazon Web Services under ASN 16509 and is geolocated in Japan. No SSL certificate was presented during the HTTPS handshake, indicating that the site either served only HTTP or used a self‑signed certificate that was not recorded. The page title returned by the HTTP response is “Ledger Live”, matching the targeted brand and reinforcing the impersonation claim. Google Safe Browsing lists the domain under the social‑engineering category, and the same classification appears twice in the supplied flags.

VirusTotal analysis shows that 13 out of 93 scanning engines have flagged the domain, a signal that multiple independent tools consider it malicious. The domain is currently listed on at least one public blocklist and has been blocked by the PhishDestroy service, confirming that protective networks have already taken action. Nameserver information was not retrievable, and the registrar details are absent, limiting the ability to trace ownership. The site’s status is reported as offline, which may be the result of takedown actions or temporary hosting changes.

Despite the offline state, the infrastructure evidence—AWS hosting, Japanese IP, lack of TLS, matching page title, and multiple vendor detections—provides a clear indicator of a credential‑stealing or crypto‑drain attack aimed at Ledger users. Defenders should continue to block the domain at DNS and proxy layers, monitor AWS‑hosted address ranges for similar patterns, and update endpoint protection signatures with the observed hash of the page title. Incident response teams should also review any recent Ledger‑related login attempts originating from Japan or from the 3.175.227.82 address, and consider notifying affected users about the impersonation attempt.