app-ledgerrliv-app[.]webflow[.]io

This domain, app-ledgerrliv-app.webflow.io, is flagged as a brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site mimics the official Ledger Live application interface, likely aiming to deceive users into entering sensitive credentials or installing malicious software under the guise of a legitimate crypto wallet service. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and content align with typical brand impersonation tactics used in credential theft or malware distribution campaigns. Infrastructure analysis reveals the domain was registered through NameCheap, Inc., and resolves to IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). The domain was created on February 21, 2026, though this date may reflect a falsified record or a placeholder. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which, while not inherently malicious, is commonly exploited by threat actors to lend false legitimacy to phishing sites. As of the latest assessment, the domain has been taken offline, likely following detection and reporting. It is currently blocked by at least one security provider. Despite its offline status, the domain remains a residual risk due to potential reuse or re-registration by threat actors. Users who interacted with the site should assume credential exposure, revoke any active sessions, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.