ledgerlive-secure[.]org

Analysis of ledgerlive-secure.org indicates a crypto-focused phishing domain impersonating Ledger, a hardware wallet provider. The domain was registered on February 21, 2026, through Atak Domain Bilgi Teknolojileri A.Ş. and currently resolves to 104.21.56.88, an IP address hosted on Cloudflare's network (AS13335) in the United States. Infrastructure review shows the domain uses Cloudflare nameservers (kristin.ns.cloudflare.com and stan.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), consistent with Cloudflare's proxy services. The site's page title, 'Suspected phishing site | Cloudflare,' suggests it was flagged by Cloudflare's internal systems prior to takedown.

Detection data is limited but notable: three of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk classification. The domain was explicitly blocked by PhishDestroy, and its scam type is documented as a crypto scam. No evidence of active content remains, as the domain is currently offline.

Defenders should treat this domain as confirmed phishing infrastructure targeting Ledger users. The use of Cloudflare proxy services and a recently registered domain aligns with common phishing tactics to evade detection and maintain anonymity. While the exact phishing kit or payload is not analyzed, the domain's registration details, hosting provider, and detection history provide sufficient evidence for blocking or sinkholing. Organizations should monitor for related domains using similar naming conventions (e.g., 'ledgerlive-[modifier]') and assess logs for connections to 104.21.56.88 or the domain's nameservers during its active period.