support-legar--help[.]webflow[.]io

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Ledger cryptocurrency wallet users. Analysis indicates the infrastructure was designed to deceive victims into disclosing wallet credentials or installing malicious software under the guise of official Ledger support resources, a technique commonly associated with crypto drainer operations. Infrastructure analysis reveals the domain support-legar--help.webflow.io was registered through Webflow on April 28, 2026, with an anomalous future creation date suggesting potential domain spoofing or registry manipulation. The domain resolved to IP address 104.18.36.248, hosted on Cloudflare infrastructure in Canada, and presented a page titled 'Ledger® Live: Desktop | Getting started with Ledger 𝐒𝐮𝐩𝐩𝐨𝐫𝐭.' Security vendors on VirusTotal detected malicious activity, with 19 out of 95 engines flagging the domain. The SSL certificate was issued by Google Trust Services (WE1), and the domain appeared on one security blocklist, specifically PhishDestroy. The combination of brand impersonation, crypto-focused deception, and anomalous registration data elevates the risk profile. Organizations and individuals should implement targeted mitigation measures to counter this specific threat type. Immediately block the domain and IP address 104.18.36.248 at the network perimeter and endpoint levels. Ledger users should be alerted to verify all support communications through official channels only, particularly avoiding any domain containing 'webflow.io' or variations of 'ledger' with misspellings or additional characters. Monitor for similar impersonation patterns, such as domains registered through Webflow or other web hosting platforms that mimic cryptocurrency wallet providers. Security teams should review logs for connections to the flagged IP and domain, prioritizing investigations into any associated credential submissions or software downloads.