en-ledger-live-login[.]blogspot[.]be

The domain en-ledger-live-login.blogspot.be is confirmed as a brand impersonation site targeting the cryptocurrency wallet service Ledger. The domain is currently offline and has been identified as a potential threat to users attempting to access their Ledger Live accounts.

Analysis indicates that the domain was registered through Google (ASN: 15169) and resolves to the IP address 2a00:1450:4001:82a::2001, located in Germany (DE) under the AS15169 Google LLC network. The domain has been flagged by 13 of 95 VirusTotal security vendors, indicating a moderate level of suspicion among the cybersecurity community. Additionally, the site appears on 2 security blocklists and is blocked by PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services / WE2, which may have been used to gain user trust. The page title 'Ledger Live Login - Step-by-Step Guide' suggests an attempt to mimic official Ledger content to deceive users.

Given the current status of the domain as offline, the immediate risk to users is mitigated. However, users should remain vigilant and avoid any links or redirects that lead to similar domains. Security teams are advised to monitor for any resurgence of this domain or related phishing infrastructure. Organizations should also update their security policies to include this domain in their blocklists and educate employees about the risks of brand impersonation attacks targeting cryptocurrency services.