ledgeraml[.]live

PhishDestroy first observed ledgeraml.live on Aug 28, 2025. The hostname explicitly references Ledger; stored content metadata identifies the same apparent target. The captured page title is “Ledger Support”. Stored page analysis classifies the content as crypto scam. Current evidence score: 95/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, URLQuery, and URLScan. VirusTotal recorded 1 detections among 95 engines: Gridinsoft on Feb 23, 2026 at 05:26 UTC. URLQuery recorded 100 detections; no observation timestamp was retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Ledger and assigned phishing as its category on Jul 29, 2026 at 03:41 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:19 UTC; content was unavailable. At collection time, the hostname resolved to 172.67.198.197 on AS13335 (CLOUDFLARENET, US). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. DOM analysis on Mar 24, 2026 at 05:24 UTC returned 70/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan.

The content indicators and 3 positive source findings support the current Ledger-themed crypto scam classification.