live-ledgrlive-en-us[.]teachable[.]com

live-ledgrlive-en-us.teachable.com was registered on 21 February 2026 through Amazon Registrar, Inc. The domain resolves to 34.54.192.65, an address owned by Google LLC (AS396982) located in the United States. DNS is served by Cloudflare nameservers ian.ns.cloudflare.com and nina.ns.cloudflare.com, while the TLS certificate is issued by Google Trust Services under the WR3 profile, indicating a legitimate‑looking HTTPS endpoint. HTTP requests return a 404 status with the page title “404 Error - Teachable”, confirming that the site is currently serving a generic error page rather than a credential‑harvesting form. Infrastructure analysis shows the use of Google Cloud services, Google Cloud CDN, HTTP/3, HSTS, and the Mailgun email delivery platform, all of common components in phishing kits.

The domain is flagged by one of ninety‑three VirusTotal scanners and appears on a single external blocklist; it has also been listed by PhishDestroy as offline. The observed threat vector is a brand‑impersonation campaign targeting Ledger, classified as a crypto‑scam, and the risk rating is elevated. At present the site is taken offline, so active exploitation cannot be confirmed.

However, the combination of recent registration, a trusted TLS certificate, and the use of reputable cloud services suggests an attempt to lend credibility to malicious communications that may reference Ledger. Defenders should continue to monitor the domain for re‑activation, add it to internal blocklists, and watch for associated Mailgun sender addresses or similar subdomains that could be used in future campaigns. Correlation with email phishing samples referencing Ledger and the IP address 34.54.192.65 will help identify any broader infrastructure reuse.