usa-ledger[.]live

The domain usa-ledger.live was observed hosting a wallet/seed phishing page that mimics the official Ledger Live interface, as indicated by the page title "Ledger Live - Secure Hardware Wallet Management". The site resolved to the IP address 188.114.96.3, which belongs to AS13335 owned by Cloudflare, Inc., and the domain is registered through Cloudflare’s registrar service. No TLS certificate was presented, implying the site operated over plain HTTP at the time of capture. The nameservers katelyn.ns.cloudflare.com and peyton.ns.cloudflare.com are standard Cloudflare records, confirming the hosting provider.

Security intelligence shows the domain appears on a single blocklist and is actively blocked by PhishDestroy. VirusTotal analysis recorded 13 detections out of 95 scanned vendors, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. The infrastructure was taken offline before this report, so live probing is not possible, and no additional artifacts such as payload hashes or command‑and‑control endpoints have been disclosed.

Uncertainty remains around the exact phishing kit used and whether any victim credentials were harvested before takedown. Defenders should add usa-ledger.live to internal blocklists, monitor for any traffic to 188.114.96.3 from corporate networks, and enforce TLS inspection to detect attempts to contact the domain over HTTP. Email gateways should be tuned to flag messages that reference Ledger or contain URLs resembling the domain pattern. Continuous monitoring of Cloudflare‑hosted assets for similar impersonation attempts is recommended, as the provider is frequently abused for fast‑flux style deployments.