firmwareupdate-ledgerlive[.]com

Analysis of firmwareupdate-ledgerlive.com shows multiple indicators of a high‑risk brand‑impersonation campaign targeting Ledger users. The domain was registered through NiceNIC International Group Co., Limited on 04 Nov 2025 and uses Cloudflare’s DNS infrastructure (heather.ns.cloudflare.com, mitchell.ns.cloudflare.com) that resolves to IP 104.21.44.147, an address belonging to AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented for the host, leaving the connection unencrypted. Google Safe Browsing has flagged the site for social engineering, and PhishDestroy has added it to its blocklist.

VirusTotal reports that 16 of 95 security vendors classify the domain as malicious, reinforcing the suspicion. Independent reputation services assign extremely low trust scores—Gridinsoft 0/100 and Scamadviser 1/100—consistent with a fraudulent operation. The page title returned during the brief online window was “Ledger Live Dashboard,” directly echoing Ledger’s official product name, and the intelligence tags the activity as a crypto scam that impersonates Ledger.

The domain is currently taken offline, but the infrastructure—Cloudflare front‑end, the same registrar, and the lack of SSL—remains reusable for future impersonation attempts. Defenders should continue to block the IP address and associated nameservers, add the domain to internal deny lists, and monitor for newly registered domains that employ similar naming patterns or share the Cloudflare hosting footprint. Monitoring for additional detections from anti‑phishing feeds and rapid re‑registration of the domain will help mitigate repeat abuse.