ledg[.]erlive[.]app

The domain ledg.erlive.app was observed hosting a malicious site that impersonates the Ledger brand and is classified as a crypto‑scam. The site presented a generic "Home Page" title and lacked an SSL certificate, indicating unencrypted HTTP service. Network analysis shows the domain resolves to the IP address 104.21.16.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States.

VirusTotal scans recorded 13 detections out of 95 security vendors, reflecting a moderate level of consensus among analysis engines. Independent reputation services assigned a Gridinsoft trust score of zero out of one hundred, and the domain is listed on two known blocklists, PhishDestroy and ScamSniffer. The site’s operational status is currently offline, and no nameserver information was available at the time of investigation.

The combination of brand impersonation, lack of transport‑layer security, low trust score, and multiple vendor detections supports the determination that ledg.erlive.app is a confirmed crypto‑scam infrastructure targeting Ledger users. Defenders should add the domain and its resolved IP address to inbound and outbound filtering rules, monitor for any re‑hosting attempts on alternate IP ranges, and incorporate the observed indicators into threat‑intel feeds. Continuous re‑query of the domain’s DNS and blocklist status is recommended to detect potential re‑activation.