legderlive[.]org

On July 25, 2026 analysts reviewed the domain legderlive.org, which is currently offline but was previously hosting a wallet‑seed phishing campaign targeting Ledger users. The domain was registered on October 26, 2025 through CNOBIN INFORMATION TECHNOLOGY LIMITED and resolved to the IP address 172.67.184.233, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS resolution used Cloudflare’s authoritative name servers edward.ns.cloudflare.com and sierra.ns.cloudflare.com. No TLS certificate was observed for the site, indicating that communications were not encrypted.

Security telemetry shows the domain appears on a single blocklist and has been actively blocked by PhishDestroy. VirusTotal scans returned twelve positive detections out of ninety‑five submitted engines, reinforcing the malicious classification. Independent reputation scoring from Gridinsoft assigned a trust score of zero out of one hundred, further confirming the site’s lack of legitimacy. The listed brand target is Ledger, and the scam type is identified as wallet/seed phishing, suggesting that the site likely attempted to harvest private recovery phrases from cryptocurrency hardware wallet users.

While the offline status precludes direct verification of the site’s content, the combination of registration timing, hosting on a Cloudflare edge, absence of SSL, and the detection footprint provides sufficient evidence to label the domain as a confirmed Ledger impersonation phishing operation. Defenders should continue to block legderlive.org at DNS and web proxy layers, monitor for any resurrection of the domain on alternative hosting, and incorporate the indicator set (domain, IP, hosting ASN, and associated blocklist entries) into threat‑intel feeds.