l-leger[.]com

The domain l-leger.com was registered on 2026-04-30 through MAT BAO CORPORATION and is currently taken offline. Infrastructure analysis shows the domain resolves to the IPv6 address 2a06:98c1:3121::3, which is hosted by Cloudflare (AS13335) in the United States. The site presented a valid Let's Encrypt certificate issued under the E7 profile, confirming the use of standard TLS termination on Cloudflare's edge network. Nameservers finley.ns.cloudflare.com and raina.ns.cloudflare.com are also Cloudflare‑controlled, indicating the attacker leveraged a reputable CDN to obscure origin hosting.

The page title observed during a brief fetch was "Ledger Live: The Ultimate Crypto Management App | Ledger Key," directly referencing Ledger’s product suite and confirming a brand‑impersonation tactic targeting Ledger users. Gridinsoft assigned a trust score of 0/100, reflecting an extremely low confidence rating for benign activity. VirusTotal scans returned 13 positive detections out of 91 security vendors, corroborating the malicious classification. The domain appears on three external blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple threat‑intel providers have surfaced the indicator.

While the site is no longer reachable, the combination of recent registration, Cloudflare‑based hosting, a legitimate TLS certificate, and a brand‑targeted page title provides a clear fingerprint for detection. defenders should add l-leger.com to URL filtering policies, ensure DNS‑based blocklists include the domain, and monitor for any re‑registration or similar sub‑domains that reuse the same hosting patterns or page titles. Continuous re‑evaluation is advised in case the actor reactivates the domain or deploys a replica with altered content.