Ledger

Crypto & web3 Franceledger.comRank 40 of the most impersonated
Cert findings · 24 h
21
Cert findings · 7 days
88
46 reported or listed · 40 on phishing hosts · 2 on Spamhaus DROP
Registered lookalikes
356
66 listed by a source or an address list
Official domains
3
verified from Ledger's own sites and records

Certificate findings for Ledger

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Ledger's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 137 findings, grouped by hostname

  1. info-ledgerlive.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    info-ledgerlive.pages.dev
    First seen
    2026-11-05 10:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 09:36 UTC to 2027-02-03 10:35 UTC
    Logged 2026-11-05 10:36 UTC in Google ParcelYard2027h1, entry 624,307,797
    SHA-256 09d0e4a222ec27bae8a5361141fb410f328401eadeb7099b98795fe8b4753424
    Public key SHA-256 c4f85a84d7afbea3161ebce2bb1a9d3eafb22afb1d0064721425e692f2a9820b
    Brand
    Ledger
    Addresses
    172.66.45.29 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.227 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d1d
    2606:4700:310c::ac42:2ee3
    Cloudflare
    Cloudflare (172.66.45.29, 172.66.46.227): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  2. started-ledger-live-download-eng.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    started-ledger-live-download-eng.pages.dev
    First seen
    2026-11-05 08:57 UTC
    First published
    2026-11-05 09:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 07:54 UTC to 2027-02-03 08:53 UTC
    Logged 2026-11-05 08:54 UTC in IPng Networks Halloumi2027h1, entry 371,985,592
    SHA-256 e8e2a164e6beafa7f8a43053267d57d3e78a91697e462d3b468a6a650db267a2
    Public key SHA-256 8059d684378c1e013499dd42e120d2bdddc7e566d1ba35356dbabf29ffd6e34a
    Brand
    Ledger
    Addresses
    172.66.45.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.218 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d26
    2606:4700:310c::ac42:2eda
    Cloudflare
    Cloudflare (172.66.45.38, 172.66.46.218): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  3. ledger-live-loginn-io.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-loginn-io.pages.dev
    First seen
    2026-11-05 08:00 UTC
    First published
    2026-11-05 08:42 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:45 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 06:59 UTC to 2027-02-03 07:56 UTC
    Logged 2026-11-05 07:59 UTC in Google PlumbersArms2027h1, entry 622,641,722
    SHA-256 c716fcb7f2c904d341e870162be009d8826d6782a59c14bd89a2c3b905e56d10
    Public key SHA-256 0aad34bbd02932183fc747df90a5fdc2e7f6590ce4c508ef2c8507eed1ea932b
    Brand
    Ledger
    Addresses
    172.66.44.83 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c53
    2606:4700:310c::ac42:2fad
    Cloudflare
    Cloudflare (172.66.44.83, 172.66.47.173): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  4. ledgerlive-profile-eu.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-profile-eu.wasmer.app
    First seen
    2026-11-05 03:11 UTC
    First published
    2026-11-05 04:10 UTC
    DNS
    Resolves · checked 2026-11-05 04:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-05 02:10 UTC to 2027-02-03 02:10 UTC
    Logged 2026-11-05 03:09 UTC in Google PlumbersArms2027h1, entry 619,318,416
    SHA-256 76ef8f248b3eaf8802c2d9c2e5a1eedbf7199f565dda43b86292656fd0a03a17
    Public key SHA-256 f0b5e00e4883a21cadeecd605be3b09bbf1277c8052c0de7b6514c8e49dcc905
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  5. ledger-live-in-log.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-in-log.pages.dev
    First seen
    2026-11-05 01:41 UTC
    First published
    2026-11-05 01:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 00:38 UTC to 2027-02-03 01:37 UTC
    Logged 2026-11-05 01:38 UTC in DigiCert Wyvern2027h1, entry 409,784,365
    SHA-256 21d8bc6306bb947fd2ef87cdc338bd3a9bffe440447b9ee91eca08f2dd1f3172
    Public key SHA-256 582ae1e3a63184d25a4e3bd16b2a8e9ab285e1b0905e3f798517e06515f1d8f1
    Brand
    Ledger
    Addresses
    172.66.44.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cb6
    2606:4700:310c::ac42:2f4a
    Cloudflare
    Cloudflare (172.66.44.182, 172.66.47.74): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  6. ledgerlive-migrate-ru.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-migrate-ru.wasmer.app
    First seen
    2026-11-05 01:01 UTC
    First published
    2026-11-05 01:50 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-05 00:01 UTC to 2027-02-03 00:01 UTC
    Logged 2026-11-05 00:59 UTC in Google ParcelYard2027h1, entry 617,493,002
    SHA-256 755489b804ecfab7af45c3af45a6e19c3e0aa1424702a16e3cde340afa6f85d6
    Public key SHA-256 868f98db91c36feed9fc4b65421164c99849a766ce929bca17714fbab686dc61
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  7. ledgerlive-guide-fr.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-guide-fr.wasmer.app
    First seen
    2026-11-04 23:48 UTC
    First published
    2026-11-05 00:41 UTC
    DNS
    Resolves · checked 2026-11-05 00:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 22:44 UTC to 2027-02-02 22:44 UTC
    Logged 2026-11-04 23:43 UTC in Google PlumbersArms2027h1, entry 616,887,447
    SHA-256 1e6e254105722cfa1553dc2dafcf905a331db1889c54e876c37d1a6ad9d16c5f
    Public key SHA-256 e89f3ccab30552e843180fc1de4bb3407afe143fcb0bb0d95c5f1fe3c8be1c57
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  8. ledgerlive-service.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    ledgerlive-service.com
    First seen
    2026-11-04 23:31 UTC
    First published
    2026-11-05 00:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:49 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-01-21 19:28 UTC
    Logged 2026-11-04 23:30 UTC in Geomys Tuscolo2027h1, entry 479,172,261
    SHA-256 598a57609294c51bef73e90337be2402ce713674a74c044c189d4a43470e1c19
    Public key SHA-256 5690f7d13e691ce7123e84ac2aa6c2684c67ea3891c9dc8792bc4e30b60e920e
    PhishDestroy
    Brand
    Ledger
    Addresses
    104.21.57.241 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.194.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:39f1
    2606:4700:3036::ac43:c23a
    Cloudflare
    Cloudflare (104.21.57.241, 172.67.194.58): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledgerlive-service.com
    Registered
    2026-03-31 · OwnRegistrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:43 UTC

    Suggest a correction

  9. ask-ledgerlive-log-net.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ask-ledgerlive-log-net.wasmer.app
    First seen
    2026-11-04 22:26 UTC
    First published
    2026-11-04 23:32 UTC
    DNS
    Resolves · checked 2026-11-04 23:38 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 21:25 UTC to 2027-02-02 21:25 UTC
    Logged 2026-11-04 22:23 UTC in Let's Encrypt Sycamore2027h1, entry 948,346,819
    SHA-256 7a2e22944bdc02934227ca1d49def61fa5a95ba4997b26c8e4b2859b5d266537
    Public key SHA-256 cc695cfe7a43ea8819e69ab7c27db91e9165b8e9073726d3b6a94834ab2b9200
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  10. start-ledgerlive-download.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    start-ledgerlive-download.pages.dev
    First seen
    2026-11-04 22:05 UTC
    First published
    2026-11-04 22:19 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:27 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 21:02 UTC to 2027-02-02 22:01 UTC
    Logged 2026-11-04 22:02 UTC in Google PlumbersArms2027h1, entry 615,652,289
    SHA-256 1469b29aff0df027b38fa50fba6589e8d06d5647b92f0e05f6d1b7ba98144c1b
    Public key SHA-256 521cffb9ac2fa23b63c91bc0502e46f18a86fc16eb95f9ae4d4acb0b69733b04
    Brand
    Ledger
    Addresses
    172.66.44.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c75
    2606:4700:310c::ac42:2f8b
    Cloudflare
    Cloudflare (172.66.44.117, 172.66.47.139): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  11. pay.myledgerwallet.com US · AS14618 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesReported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 16 mo ago
    DetailsHide
    Hostname
    pay.myledgerwallet.com
    First seen
    2026-11-04 20:11 UTC
    First published
    2026-11-04 21:09 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 21:16 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-04 20:07 UTC to 2027-05-21 20:07 UTC
    Logged 2026-11-04 20:07 UTC in Google Argon2027h1, entry 863,505,692
    SHA-256 6f7bf9070b0f252f24af79d8951291de4b443604cdf8d5bc571f73fe49f65ce4
    Public key SHA-256 770244ac84107290dbf209060d3a9b6eb999ea60d678ec5015af07aa8cee5f30
    PhishDestroy
    Brand
    Ledger
    Addresses
    100.49.0.246 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    100.49.110.141 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (100.49.0.246, 100.49.110.141): a cloud provider. It rents servers and addresses to its customers.
    Domain
    myledgerwallet.com
    Registered
    2025-07-27 · GoDaddy.com, LLC
    MX
    Receives mail at myledgerwallet-com.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 21:09 UTC

    Suggest a correction

  12. www.pay.myledgerwallet.com
    ReportedUnder pay.myledgerwallet.com, reported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 16 mo ago
    DetailsHide
    Hostname
    www.pay.myledgerwallet.com
    First seen
    2026-11-04 20:11 UTC
    First published
    2026-11-04 21:09 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving · checked 2026-11-04 21:16 UTC
    Reported
    PhishDestroy, listing pay.myledgerwallet.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-04 20:07 UTC to 2027-05-21 20:07 UTC
    Logged 2026-11-04 20:07 UTC in Google Argon2027h1, entry 863,505,692
    SHA-256 6f7bf9070b0f252f24af79d8951291de4b443604cdf8d5bc571f73fe49f65ce4
    Public key SHA-256 770244ac84107290dbf209060d3a9b6eb999ea60d678ec5015af07aa8cee5f30
    PhishDestroy
    Brand
    Ledger
    Domain
    myledgerwallet.com
    Registered
    2025-07-27 · GoDaddy.com, LLC
    MX
    Receives mail at myledgerwallet-com.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 21:09 UTC

    Suggest a correction

  13. first-ledger-live-download-eng-us.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    first-ledger-live-download-eng-us.pages.dev
    First seen
    2026-11-04 17:36 UTC
    First published
    2026-11-04 18:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:17 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 16:31 UTC to 2027-02-02 17:29 UTC
    Logged 2026-11-04 17:31 UTC in Google ParcelYard2027h1, entry 612,014,451
    SHA-256 1d46f2101399feecf6eeb6abe0865767c3abfa557f8eba9b6951e6ff4c86fc7e
    Public key SHA-256 3f6c879d05fd9fa4a3283bceb7b581ce92ce7567a763b33140cc0acc75c4587a
    Brand
    Ledger
    Addresses
    172.66.44.97 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.159 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c61
    2606:4700:310c::ac42:2f9f
    Cloudflare
    Cloudflare (172.66.44.97, 172.66.47.159): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  14. ledger-wallet-support.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-wallet-support.pages.dev
    First seen
    2026-11-04 17:10 UTC
    First published
    2026-11-04 18:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:17 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 16:07 UTC to 2027-02-02 17:03 UTC
    Logged 2026-11-04 17:07 UTC in Google PlumbersArms2027h1, entry 612,136,642
    SHA-256 a5e4aa415663105a19a31037aed3dbb3a55504975125884f152ee5ab9b1384cb
    Public key SHA-256 f29e370d51f2eefb67179e3d9f20349225a16f868c901210e3122d968b695f9f
    Brand
    Ledger
    Addresses
    172.66.44.176 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.80 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cb0
    2606:4700:310c::ac42:2f50
    Cloudflare
    Cloudflare (172.66.44.176, 172.66.47.80): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  15. first-ledger-live-login-eng-us.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    first-ledger-live-login-eng-us.pages.dev
    First seen
    2026-11-04 14:31 UTC
    First published
    2026-11-04 15:43 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:48 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 13:28 UTC to 2027-02-02 14:27 UTC
    Logged 2026-11-04 14:28 UTC in Geomys Tuscolo2027h1, entry 474,123,820
    SHA-256 f80432f67f0c2349e450b59f7303627a630069290a75ff945736b29a1099d5a0
    Public key SHA-256 d63a6255a27ac074dfdf3e179ecb503be9bd397def20a9428451bf7ccaacdf7f
    Brand
    Ledger
    Addresses
    172.66.44.79 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.177 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c4f
    2606:4700:310c::ac42:2fb1
    Cloudflare
    Cloudflare (172.66.44.79, 172.66.47.177): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  16. www.ledgerwallet.org.cn HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.ledgerwallet.org.cn
    First seen
    2026-11-04 13:52 UTC
    First published
    2026-11-04 14:35 UTC
    DNS
    Resolves · checked 2026-11-04 14:46 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-04 12:51 UTC to 2027-02-02 12:51 UTC
    Logged 2026-11-04 13:49 UTC in Geomys Tuscolo2027h1, entry 473,782,936
    SHA-256 963968b8a34670f41f4ed35c9ef08a5867ab6b2fb723f8ec416e58b1e8d8dacb
    Public key SHA-256 ed601ae0f3969d41db9e3933f2ada9693f86e83a1cfb61ad8cb1d212d5bf3516
    Brand
    Ledger
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    ledgerwallet.org.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:18 UTC

    Suggest a correction

  17. m.ledgerwallet.org.cn HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    m.ledgerwallet.org.cn
    First seen
    2026-11-04 13:52 UTC
    First published
    2026-11-04 14:35 UTC
    DNS
    Resolves · checked 2026-11-04 14:46 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-04 12:51 UTC to 2027-02-02 12:51 UTC
    Logged 2026-11-04 13:49 UTC in Geomys Tuscolo2027h1, entry 473,782,936
    SHA-256 963968b8a34670f41f4ed35c9ef08a5867ab6b2fb723f8ec416e58b1e8d8dacb
    Public key SHA-256 ed601ae0f3969d41db9e3933f2ada9693f86e83a1cfb61ad8cb1d212d5bf3516
    Brand
    Ledger
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    ledgerwallet.org.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:18 UTC

    Suggest a correction

  18. ledgerwallet.org.cn HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    ledgerwallet.org.cn
    First seen
    2026-11-04 13:52 UTC
    First published
    2026-11-04 14:35 UTC
    DNS
    Resolves · checked 2026-11-04 14:46 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-04 12:51 UTC to 2027-02-02 12:51 UTC
    Logged 2026-11-04 13:49 UTC in Geomys Tuscolo2027h1, entry 473,782,936
    SHA-256 963968b8a34670f41f4ed35c9ef08a5867ab6b2fb723f8ec416e58b1e8d8dacb
    Public key SHA-256 ed601ae0f3969d41db9e3933f2ada9693f86e83a1cfb61ad8cb1d212d5bf3516
    Brand
    Ledger
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    ledgerwallet.org.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:18 UTC

    Suggest a correction

  19. ledgerwallet.im HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    ledgerwallet.im
    First seen
    2026-11-04 09:02 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Resolved to 206.161.218.138
    3. Latest DNS check
    Brand
    Ledger
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    ledgerwallet.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:35 UTC

    Suggest a correction

  20. www.ledgerwallet.im HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.ledgerwallet.im
    First seen
    2026-11-04 09:00 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Resolved to 206.161.218.138
    3. Latest DNS check
    Brand
    Ledger
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    ledgerwallet.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:35 UTC

    Suggest a correction

  21. web3.ledgerwallet.im HK · AS135357 · HONG KONG KOWLOON TELECOMMU…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    web3.ledgerwallet.im
    First seen
    2026-11-04 08:58 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Resolved to 206.161.218.138
    3. Latest DNS check
    Brand
    Ledger
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    94.154.43.8 · United States · AS219502 STORMCLOUD-AS Storm Industries LLC
    Domain
    ledgerwallet.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:35 UTC

    Suggest a correction

  22. ledger--ive-login.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger--ive-login.pages.dev
    First seen
    2026-11-04 07:25 UTC
    First published
    2026-11-04 08:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:17 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 06:22 UTC to 2027-02-02 07:19 UTC
    Logged 2026-11-04 07:22 UTC in DigiCert Wyvern2027h1, entry 399,453,369
    SHA-256 60537186a0b4b902e834b1f86a29758c9e9a3f84c20cd1d3d87ff5ae3ec479be
    Public key SHA-256 3559f413ed726e9b67af346302d98cc19e222187efbbb3ec681ba1e1f5a72467
    Brand
    Ledger
    Addresses
    172.66.45.13 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d0d
    2606:4700:310c::ac42:2ef3
    Cloudflare
    Cloudflare (172.66.45.13, 172.66.46.243): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  23. ledger-live-cloud-can.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-cloud-can.pages.dev
    First seen
    2026-11-03 23:10 UTC
    First published
    2026-11-03 23:22 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 23:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 22:06 UTC to 2027-02-01 23:04 UTC
    Logged 2026-11-03 23:06 UTC in Google PlumbersArms2027h1, entry 598,859,982
    SHA-256 c1a551264ff9410f6a7eefc03099f0c8841cc5200b96d5e5e60c2fd64045662a
    Public key SHA-256 e968c5aa99eaa3ce378e26f64bb2034774fce9ad9d0d19ef7d4966acda4f76c9
    Brand
    Ledger
    Addresses
    172.66.44.108 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c6c
    2606:4700:310c::ac42:2f94
    Cloudflare
    Cloudflare (172.66.44.108, 172.66.47.148): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  24. ledger-live-nft.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-nft.pages.dev
    First seen
    2026-11-03 22:26 UTC
    First published
    2026-11-03 23:22 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 23:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 21:24 UTC to 2027-02-01 22:23 UTC
    Logged 2026-11-03 22:25 UTC in Google ParcelYard2027h1, entry 597,976,389
    SHA-256 1a9d6603d5d58b2a8a3737c3c42755d62d9a7853ddb3940398805225790c5b51
    Public key SHA-256 391199deb23192cc0ae298450ac688d7fbce344d2593b7fe1f3bb1b62429a8bb
    Brand
    Ledger
    Addresses
    172.66.44.85 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.171 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c55
    2606:4700:310c::ac42:2fab
    Cloudflare
    Cloudflare (172.66.44.85, 172.66.47.171): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  25. www.ledgerlive-app.site SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    www.ledgerlive-app.site
    First seen
    2026-11-03 21:11 UTC
    First published
    2026-11-03 21:33 UTC
    DNS
    Resolves · checked 2026-11-04 21:40 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 20:08 UTC to 2027-02-01 20:08 UTC
    Logged 2026-11-03 21:06 UTC in IPng Networks Gouda2027h1, entry 306,887,764
    SHA-256 375b444fb0c6064f4f6cca017561ac3a5b5d71cfb4601171a588e1ccf8b488b4
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Ledger
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ledgerlive-app.site
    Registered
    2026-08-22 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 21:33 UTC

    Suggest a correction

  26. ledgerlive-sync-log.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-sync-log.wasmer.app
    First seen
    2026-11-03 19:11 UTC
    First published
    2026-11-03 19:26 UTC
    DNS
    Resolves · checked 2026-11-04 19:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 18:08 UTC to 2027-02-01 18:08 UTC
    Logged 2026-11-03 19:07 UTC in IPng Networks Gouda2027h1, entry 305,908,871
    SHA-256 9ccc06e86260db44ef44f9862d297a20c974eab3e4db4a5ddc4a8e5b7dbf5569
    Public key SHA-256 bfa96e42a0584db412efd68317158eaf019dfbdd372c7fca442485bf6d02f467
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  27. ledgerlive-updates-fr.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-updates-fr.wasmer.app
    First seen
    2026-11-03 18:21 UTC
    First published
    2026-11-03 19:26 UTC
    DNS
    Resolves · checked 2026-11-04 19:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 17:16 UTC to 2027-02-01 17:16 UTC
    Logged 2026-11-03 18:15 UTC in Google PlumbersArms2027h1, entry 595,194,191
    SHA-256 2e7f80dba9c9c072b7ec2fb75e428fbcf4e37656d34b7b626ee3bd0736226180
    Public key SHA-256 deb344594f3c611d4c8340c625e17206feec5800d850cc8415827e7ecec6ad25
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  28. ledgerlive-ledgers.us US · AS53667 · FranTech Solutions2 addresses
    ReportedPhishing hostSame certificateReported by PhishDestroy · Address hosted confirmed phishing in the last 48 h · Same certificate as www.ledgerlive-ledgers.us.trezor-suitetrezor.us, listed by MetaMask (under trezor-suitetrezor.us) · Same certificate as www.ledgerlive-ledgers.us.trezor-suitetrezor.us, listed by MetaMask (under trezor-suitetrezor.us)MX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    ledgerlive-ledgers.us
    First seen
    2026-11-03 17:36 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.144.
    1. Phishing-host list fetched with the address
    2. Resolved to 198.251.89.144
    Same certificate
    Same certificate as www.ledgerlive-ledgers.us.trezor-suitetrezor.us: listed by MetaMask (under trezor-suitetrezor.us); on a phishing host at 198.251.89.144; a Trezor lookalike
    Hosting-alias name of www.ledgerlive-ledgers.us.trezor-suitetrezor.us
    Ledger appears in this hostname
    Resolved to 173.211.81.11, an address that hosted confirmed phishing
    2 of 3 domains on this certificate have their own listing evidence
    Certificate 7c744a70b61221e2… · 3 domains on it · first seen 2026-11-03 17:36 UTC
    Same certificate
    Same certificate as www.ledgerlive-ledgers.us.trezor-suitetrezor.us: listed by MetaMask (under trezor-suitetrezor.us); on a phishing host at 198.251.89.144; a Trezor lookalike
    Hosting-alias name of www.ledgerlive-ledgers.us.trezor-suitetrezor.us
    Ledger appears in this hostname
    Resolved to 173.211.81.11, an address that hosted confirmed phishing
    2 of 3 domains on this certificate have their own listing evidence
    Certificate 7c744a70b61221e2… · 3 domains on it · first seen 2026-11-03 17:36 UTC
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-03 16:34 UTC to 2027-02-01 16:34 UTC
    Logged 2026-11-03 17:32 UTC in DigiCert Wyvern2027h1, entry 391,322,360
    SHA-256 7c744a70b61221e244d478de2c87fe7dfc4dd584ac6dde4157a0004b71d8cc6e
    Public key SHA-256 00b6cca3eb7c7bf5b6bd810eb332813abd07c79d23263904ae3f3a5d171b52af
    PhishDestroy
    Brand
    Ledger
    Addresses
    198.251.89.144 · United States · AS53667 PONYNET - FranTech Solutions
    173.211.81.11 · United States · AS396356 LATITUDE-SH - Latitude.sh
    Domain
    ledgerlive-ledgers.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at ledgerlive-ledgers.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  29. ledger-live-authh.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-authh.pages.dev
    First seen
    2026-11-03 17:01 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 15:57 UTC to 2027-02-01 16:54 UTC
    Logged 2026-11-03 16:57 UTC in Google ParcelYard2027h1, entry 593,624,605
    SHA-256 d2661fbb476342d1cb834cd89a300dc841b0c5655c6be605f78b8809cde295bc
    Public key SHA-256 abd8f482b3fc5e6d1eac3397eb66f72a6a47aeb6479a09b24cd9b7d61ccdaa25
    Brand
    Ledger
    Addresses
    172.66.45.32 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d20
    2606:4700:310c::ac42:2ee0
    Cloudflare
    Cloudflare (172.66.45.32, 172.66.46.224): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  30. ledgerlive-verifyuser-fr.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-verifyuser-fr.wasmer.app
    First seen
    2026-11-03 16:52 UTC
    First published
    2026-11-03 17:06 UTC
    DNS
    Resolves · checked 2026-11-04 17:19 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 15:49 UTC to 2027-02-01 15:49 UTC
    Logged 2026-11-03 16:47 UTC in Google PlumbersArms2027h1, entry 593,941,654
    SHA-256 435564d22bf8e5c6d2751b64088b53d4d2f192926965d72523c58df42af66c43
    Public key SHA-256 b0e1bd65a57d49468547a142d89d3dd889ca354093c087e64f455353677b7c6b
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  31. cpcontacts.ledgerlive-ledgers.us US · AS53667 · FranTech Solutions2 addresses
    ReportedPhishing hostUnder ledgerlive-ledgers.us, reported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    cpcontacts.ledgerlive-ledgers.us
    First seen
    2026-11-03 15:56 UTC
    First published
    2026-11-03 16:45 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Reported
    PhishDestroy, listing ledgerlive-ledgers.us and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.144.
    1. Phishing-host list fetched with the address
    2. Resolved to 198.251.89.144
    Certificate
    Issued by YR1
    Valid 2026-11-03 14:53 UTC to 2027-02-01 14:53 UTC
    Logged 2026-11-03 15:51 UTC in Google ParcelYard2027h1, entry 592,782,057
    SHA-256 20296da17219d76d4d4244c3b6aac243763e38fc6c04ea7444a429ea54b8532b
    Public key SHA-256 eb6a740c05b7616c15853554c706659f8d0a4a74810b00e73c4824a32b739b55
    PhishDestroy
    Brand
    Ledger
    Addresses
    198.251.89.144 · United States · AS53667 PONYNET - FranTech Solutions
    173.211.81.11 · United States · AS396356 LATITUDE-SH - Latitude.sh
    Domain
    ledgerlive-ledgers.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at ledgerlive-ledgers.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  32. webdisk.ledgerlive-ledgers.us US · AS53667 · FranTech Solutions2 addresses
    ReportedPhishing hostUnder ledgerlive-ledgers.us, reported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    webdisk.ledgerlive-ledgers.us
    First seen
    2026-11-03 15:51 UTC
    First published
    2026-11-03 16:45 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Reported
    PhishDestroy, listing ledgerlive-ledgers.us and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.144.
    1. Phishing-host list fetched with the address
    2. Resolved to 198.251.89.144
    Certificate
    Issued by YR2
    Valid 2026-11-03 14:48 UTC to 2027-02-01 14:48 UTC
    Logged 2026-11-03 15:46 UTC in Google ParcelYard2027h1, entry 592,715,172
    SHA-256 daa2529986687a20d845337b1fb3d3fd6af47931e40ad9d07b7dc3cdf0bf21a7
    Public key SHA-256 2534b19dc347a0b9980fd32bab9e95a682d78b56f13cc2300a8271dc7f8502df
    PhishDestroy
    Brand
    Ledger
    Addresses
    198.251.89.144 · United States · AS53667 PONYNET - FranTech Solutions
    173.211.81.11 · United States · AS396356 LATITUDE-SH - Latitude.sh
    Domain
    ledgerlive-ledgers.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at ledgerlive-ledgers.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  33. ledgerlive-privacy-us.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-privacy-us.wasmer.app
    First seen
    2026-11-03 15:42 UTC
    First published
    2026-11-03 16:45 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 14:41 UTC to 2027-02-01 14:41 UTC
    Logged 2026-11-03 15:40 UTC in IPng Networks Gouda2027h1, entry 304,174,935
    SHA-256 1fbcf141422a78e7b7ff1673ab66221d30c2456073b4c20c48663993fae64c75
    Public key SHA-256 1f671c085688be01a3edeacd43ebfb4267c7da29c3ed0eed313516b1764fab43
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  34. ledgerlive-update-log.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-update-log.wasmer.app
    First seen
    2026-11-03 15:12 UTC
    First published
    2026-11-03 15:38 UTC
    DNS
    Resolves · checked 2026-11-04 15:44 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 14:07 UTC to 2027-02-01 14:07 UTC
    Logged 2026-11-03 15:06 UTC in IPng Networks Halloumi2027h1, entry 349,962,971
    SHA-256 dfaa3c276842521864c55ac56bf7898807867b0424dbdb97e46f99eef7af3691
    Public key SHA-256 69b316550d9c2cae0911079837ec90b7dfbc96170af4827a283be825e4e27bdd
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  35. www.mydevice-ledger-verification.com US · AS197769 · VPSDEDICATED-AS VPS Dedicat…
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    www.mydevice-ledger-verification.com
    First seen
    2026-11-03 14:27 UTC
    First published
    2026-11-03 15:38 UTC
    DNS
    Resolves · checked 2026-11-04 15:44 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 102.220.162.118.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 102.220.162.118
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-03 13:24 UTC to 2027-02-01 13:24 UTC
    Logged 2026-11-03 14:23 UTC in DigiCert Wyvern2027h1, entry 389,539,807
    SHA-256 44cb1c41e4cb706636ce4a97bf34132a7b726d64af1a87a886d36020c465dc9b
    Public key SHA-256 0886643e7c641fbc5baf60b3dd50c0b8ba7c321b9bc5b8d3c553591ceb896f7c
    Brand
    Ledger
    Addresses
    102.220.162.118 · United States · AS197769 VPSDEDICATED-AS VPS Dedicated LLC
    Domain
    mydevice-ledger-verification.com
    Registered
    2026-11-03 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 15:42 UTC

    Suggest a correction

  36. mydevice-ledger-verification.com US · AS197769 · VPSDEDICATED-AS VPS Dedicat…
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    mydevice-ledger-verification.com
    First seen
    2026-11-03 14:27 UTC
    First published
    2026-11-03 15:38 UTC
    DNS
    Resolves · checked 2026-11-04 15:44 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 102.220.162.118.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 102.220.162.118
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-03 13:24 UTC to 2027-02-01 13:24 UTC
    Logged 2026-11-03 14:23 UTC in DigiCert Wyvern2027h1, entry 389,539,807
    SHA-256 44cb1c41e4cb706636ce4a97bf34132a7b726d64af1a87a886d36020c465dc9b
    Public key SHA-256 0886643e7c641fbc5baf60b3dd50c0b8ba7c321b9bc5b8d3c553591ceb896f7c
    Brand
    Ledger
    Addresses
    102.220.162.118 · United States · AS197769 VPSDEDICATED-AS VPS Dedicated LLC
    Domain
    mydevice-ledger-verification.com
    Registered
    2026-11-03 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 15:42 UTC

    Suggest a correction

  37. began-ledgerlivewallet-io.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    began-ledgerlivewallet-io.pages.dev
    First seen
    2026-11-03 14:16 UTC
    First published
    2026-11-03 14:30 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 14:33 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 13:15 UTC to 2027-02-01 14:13 UTC
    Logged 2026-11-03 14:15 UTC in IPng Networks Gouda2027h1, entry 303,484,032
    SHA-256 d499a631d79d1d0167d8dc0c3cfb91ff9560a1aa87cb4e4f5cb2b53c946f03f1
    Public key SHA-256 b0a63af54f6ddad16feb2e77d5335bdbb05174298a992fcc0e7ca57f486cc8ac
    Brand
    Ledger
    Addresses
    172.66.45.6 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d06
    2606:4700:310c::ac42:2efa
    Cloudflare
    Cloudflare (172.66.45.6, 172.66.46.250): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  38. ledgerliveupdate.center HK · AS17444 · HKBN Enterprise Solutions L…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    ledgerliveupdate.center
    First seen
    2026-11-03 14:07 UTC
    First published
    2026-11-03 14:30 UTC
    DNS
    Resolves · checked 2026-11-04 14:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 58.64.137.69.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 58.64.137.69
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-03 00:00 UTC to 2027-01-29 20:06 UTC
    Logged 2026-11-03 14:01 UTC in Geomys Trastevere2027h1, entry 24,612,087
    SHA-256 2505cda84a240c216eb4d66e2535f7cc863cf365b5ea0961af3db1f637b5e595
    Public key SHA-256 d2d36426640e8f05f38e4a6c2af70605468352c372b459c0a3a482b592e8ae1e
    Brand
    Ledger
    Addresses
    58.64.137.69 · Hong Kong · AS17444 HKBNESL-AS-AP - HKBN Enterprise Solutions Limited
    Domain
    ledgerliveupdate.center
    Registered
    2025-11-02 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  39. ledgerlive-updates-in.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-updates-in.wasmer.app
    First seen
    2026-11-03 12:45 UTC
    First published
    2026-11-03 13:19 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 11:40 UTC to 2027-02-01 11:40 UTC
    Logged 2026-11-03 12:39 UTC in Google ParcelYard2027h1, entry 590,291,243
    SHA-256 2d3b6ea0aaa41cc1287535d971f8cab8ae7cd6d17307832279f351f24474b03e
    Public key SHA-256 095300fe1ceee00ba9cc542f401ce46facde72bc9f52d8351184400b77b30377
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  40. auth-ledger-live-login-eng.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    auth-ledger-live-login-eng.pages.dev
    First seen
    2026-11-03 09:05 UTC
    First published
    2026-11-03 09:58 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 08:01 UTC to 2027-02-01 09:00 UTC
    Logged 2026-11-03 09:01 UTC in Google ParcelYard2027h1, entry 587,180,861
    SHA-256 9f9f9179f2ca18eed6d616d69bdc83ab95fe9dd9303cc6016d9917c15a173e97
    Public key SHA-256 e8c293c9d424c614b2e9797b5cf858972e064ae2789271e92dbb8328e9d2df31
    Brand
    Ledger
    Addresses
    172.66.44.75 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.181 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c4b
    2606:4700:310c::ac42:2fb5
    Cloudflare
    Cloudflare (172.66.44.75, 172.66.47.181): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  41. ledgerlive-config.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-config.wasmer.app
    First seen
    2026-11-03 03:47 UTC
    First published
    2026-11-03 04:56 UTC
    DNS
    Resolves · checked 2026-11-05 05:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 02:46 UTC to 2027-02-01 02:46 UTC
    Logged 2026-11-03 03:44 UTC in Google ParcelYard2027h1, entry 583,282,205
    SHA-256 5724145d5b7b792d6c5786fddbd3a1c79118a9d99c4cf315a03cec2b63071a08
    Public key SHA-256 2ff88754c8123dbe8080ca20c9a3cd81dc99e35cc123fdfdfb81a12d920f20ec
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  42. ledgerlive-verify-account-eu.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-verify-account-eu.wasmer.app
    First seen
    2026-11-03 02:16 UTC
    First published
    2026-11-03 02:31 UTC
    DNS
    Resolves · checked 2026-11-05 02:45 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 01:12 UTC to 2027-02-01 01:12 UTC
    Logged 2026-11-03 02:11 UTC in DigiCert Sphinx2027h1, entry 338,198,430
    SHA-256 2cbc066feab2af9475dcf52c84fd8e4ae02e4e39ffa1837dcfbbc7dcb0820697
    Public key SHA-256 5067946ad7812e7b44490f49c336e8723578e0f92664add313eb0bcf22e862b5
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  43. ledgerlive-backups-eu.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-backups-eu.wasmer.app
    First seen
    2026-11-03 02:11 UTC
    First published
    2026-11-03 02:31 UTC
    DNS
    Resolves · checked 2026-11-05 02:45 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 01:09 UTC to 2027-02-01 01:09 UTC
    Logged 2026-11-03 02:08 UTC in Google ParcelYard2027h1, entry 582,186,190
    SHA-256 090567e7d26c03bd39f722605c89a7c5c3d8d66c909031fd1ffa49ed2d7413c2
    Public key SHA-256 0f43592ea18a7c1cc222c86b69baee5fedad73d6e526f6e08be9aefffadc987e
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  44. ledgerlive-core.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-core.wasmer.app
    First seen
    2026-11-03 00:52 UTC
    First published
    2026-11-03 01:20 UTC
    DNS
    Resolves · checked 2026-11-05 01:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 23:49 UTC to 2027-01-31 23:49 UTC
    Logged 2026-11-03 00:48 UTC in Let's Encrypt Willow2027h1, entry 904,826,892
    SHA-256 043a80faf60d3ce2d6de04372bf0226ee4aa8562cbe877fa610a9a6c8c3d63f6
    Public key SHA-256 a17bcee8b95f060fe88b4a4465e3cf6772b216e86f49173eb152220046613071
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  45. mainscreen-ledgerlive.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 d ago
    DetailsHide
    Hostname
    mainscreen-ledgerlive.com
    First seen
    2026-11-02 23:48 UTC
    First published
    2026-11-03 00:09 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-02 21:04 UTC to 2027-01-31 21:04 UTC
    Logged 2026-11-02 22:03 UTC in Google PlumbersArms2027h1, entry 579,682,855
    SHA-256 27fbff4373cddb855167e2757c5606625d26bd6dc60a697d3788f598d8e45d82
    Public key SHA-256 b622b2ef0e0585e176610500ba4a9de68d4607e4555865d678cbdd647a1366f0
    Brand
    Ledger
    Addresses
    104.21.63.165 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:3fa5
    2606:4700:3035::ac43:93d8
    Cloudflare
    Cloudflare (104.21.63.165, 172.67.147.216): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mainscreen-ledgerlive.com
    Registered
    2026-11-02 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  46. ledger-live-desktop-us-en.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-desktop-us-en.pages.dev
    First seen
    2026-11-02 23:21 UTC
    First published
    2026-11-03 00:09 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-02 00:00 UTC to 2027-01-24 16:46 UTC
    Logged 2026-11-02 23:19 UTC in Geomys Tuscolo2027h1, entry 451,237,085
    SHA-256 98b83ef91ed110bb2684b698e4bc7542d64fee873ea8e9615843997e7a35cb8c
    Public key SHA-256 8f53f14a5d6cf5c22834481c54ff38a3f9d920c91610be3d62a31905d8aa7c80
    Brand
    Ledger
    Addresses
    172.66.44.190 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cbe
    2606:4700:310c::ac42:2f42
    Cloudflare
    Cloudflare (172.66.44.190, 172.66.47.66): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  47. ledgerlive-updates-kr.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-updates-kr.wasmer.app
    First seen
    2026-11-02 22:37 UTC
    First published
    2026-11-02 23:02 UTC
    DNS
    Resolves · checked 2026-11-04 23:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-02 21:34 UTC to 2027-01-31 21:34 UTC
    Logged 2026-11-02 22:33 UTC in Geomys Tuscolo2027h1, entry 450,837,902
    SHA-256 2562e8ca0af2195de0fc809f54502b1b8dc4750aa15eaee935d9cd5ed3efe8fd
    Public key SHA-256 7a127a99ca63b256e537ee264483e2370e2cbf38d29691343b184d3087cc8b92
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  48. ledger-verification6-en.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledger-verification6-en.wasmer.app
    First seen
    2026-11-02 17:42 UTC
    First published
    2026-11-02 18:02 UTC
    DNS
    Resolves · checked 2026-11-04 18:09 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 16:37 UTC to 2027-01-31 16:37 UTC
    Logged 2026-11-02 17:36 UTC in IPng Networks Halloumi2027h1, entry 340,283,388
    SHA-256 405dc8ad7c0c205b250d49fcf1dc2af175308d3d15edf25afcbe1f18ef7eb3b2
    Public key SHA-256 c185ae5e2fe11e88c2a30b1f144154da8324e8d8c1ad7e561e5c43600d7b73dd
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  49. ledgerwallet-io.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledgerwallet-io.pages.dev
    First seen
    2026-11-02 15:05 UTC
    First published
    2026-11-02 15:44 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 14:02 UTC to 2027-01-31 15:01 UTC
    Logged 2026-11-02 15:02 UTC in Google ParcelYard2027h1, entry 573,959,652
    SHA-256 3d3f2e28ce08d318cd5e64568cee498b730d4905f41b73517534d3ecda71567d
    Public key SHA-256 ab46d53b4a0f9dc7abaa1d3c17ca7aadea914b8558473f15953a5b06af374893
    Brand
    Ledger
    Addresses
    172.66.44.152 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c98
    2606:4700:310c::ac42:2f68
    Cloudflare
    Cloudflare (172.66.44.152, 172.66.47.104): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  50. ledger-verification-en.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledger-verification-en.wasmer.app
    First seen
    2026-11-02 04:57 UTC
    First published
    2026-11-02 05:45 UTC
    DNS
    Resolves · checked 2026-11-05 05:52 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-02 03:53 UTC to 2027-01-31 03:53 UTC
    Logged 2026-11-02 04:52 UTC in Google PlumbersArms2027h1, entry 566,572,671
    SHA-256 950ec04fa8f592c8c758d1a68c43046c81bdc31bb602b885142ce37e583184b3
    Public key SHA-256 a5f1131c64d52c2938250ea82de1f305244a26703f9ac33223a481d6bee5df00
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  51. ledger-verification19-en.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledger-verification19-en.wasmer.app
    First seen
    2026-11-02 04:37 UTC
    First published
    2026-11-02 05:45 UTC
    DNS
    Resolves · checked 2026-11-05 05:52 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 03:36 UTC to 2027-01-31 03:36 UTC
    Logged 2026-11-02 04:34 UTC in Let's Encrypt Sycamore2027h1, entry 897,527,198
    SHA-256 8d6bbbfd42d59dac42fc6c4b9bdb9135c3c1daa5e30371f78e6d1ecd0ca429e7
    Public key SHA-256 9b24c20419c97511f20de1c93ad1e523b2239b95c32221f44bf99fee669da213
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  52. sso-ledger.live US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 26 d ago
    DetailsHide
    Hostname
    sso-ledger.live
    First seen
    2026-11-02 02:21 UTC
    First published
    2026-11-02 03:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:30 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-02 00:00 UTC to 2027-01-24 03:13 UTC
    Logged 2026-11-02 02:19 UTC in DigiCert Sphinx2027h1, entry 331,926,734
    SHA-256 0e30ed566741b95218fd1542de8487f3b70542ab09a939372567ee25d15d1536
    Public key SHA-256 2b6898e83addf14f3396e7f3c57edc8b478a0e9519b8cae128d163d366d1031a
    Brand
    Ledger
    Addresses
    104.21.96.80 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.174.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:6050
    2606:4700:3032::ac43:ae4c
    Cloudflare
    Cloudflare (104.21.96.80, 172.67.174.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    sso-ledger.live
    Registered
    2026-10-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  53. shop.ledgerlive.im HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    shop.ledgerlive.im
    First seen
    2026-11-02 00:06 UTC
    First published
    2026-11-02 01:04 UTC
    DNS
    Resolves · checked 2026-11-05 01:09 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL RSA DV SSL CA 2
    Valid 2026-09-01 00:00 UTC to 2026-11-30 23:59 UTC
    Logged 2026-11-02 00:03 UTC in Geomys Tuscolo2026h2, entry 1,033,133,507
    SHA-256 4646b79669bc62ce86cb22fdd2ac2698459abaf18f3248c2b20d2ee3ab9d6cd0
    Public key SHA-256 ad0b0e3f963a443af0c34ba66fa257a6eccb95f3be12f3814d9fc31a37b51b6e
    Brand
    Ledger
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    ledgerlive.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  54. www.ledger-wallet.us IS · AS50613 · ThorDC-AS Advania Island ehf
    ListedPhishing hostUnder ledger-wallet.us, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.ledger-wallet.us
    First seen
    2026-11-01 23:46 UTC
    First published
    2026-11-01 23:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:06 UTC
    Listed
    MetaMask, listing ledger-wallet.us and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 82.221.130.120.
    1. Phishing-host list fetched with the address
    2. Resolved to 82.221.130.120
    3. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-01 22:43 UTC to 2027-01-30 22:43 UTC
    Logged 2026-11-01 23:41 UTC in DigiCert Wyvern2027h1, entry 376,197,535
    SHA-256 833b790f779aa24c94ea62c63d700055574e985dbf04f1e1a8598d1b27973073
    Public key SHA-256 b266ec2acd3d2224c49efa0f4e2f0c11388e3eac6032bf15925f872f7ea13a2c
    Brand
    Ledger
    Addresses
    82.221.130.120 · Iceland · AS50613 ThorDC-AS Advania Island ehf
    Domain
    ledger-wallet.us
    Registered
    2026-09-02 · TLD Registrar Solutions Ltd.
    MX
    Receives mail at ledger-wallet.us
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  55. ledger-wallet.us IS · AS50613 · ThorDC-AS Advania Island ehf
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    ledger-wallet.us
    First seen
    2026-11-01 23:46 UTC
    First published
    2026-11-01 23:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:06 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 82.221.130.120.
    1. Phishing-host list fetched with the address
    2. Resolved to 82.221.130.120
    3. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-01 22:43 UTC to 2027-01-30 22:43 UTC
    Logged 2026-11-01 23:41 UTC in DigiCert Wyvern2027h1, entry 376,197,535
    SHA-256 833b790f779aa24c94ea62c63d700055574e985dbf04f1e1a8598d1b27973073
    Public key SHA-256 b266ec2acd3d2224c49efa0f4e2f0c11388e3eac6032bf15925f872f7ea13a2c
    Brand
    Ledger
    Addresses
    82.221.130.120 · Iceland · AS50613 ThorDC-AS Advania Island ehf
    Domain
    ledger-wallet.us
    Registered
    2026-09-02 · TLD Registrar Solutions Ltd.
    MX
    Receives mail at ledger-wallet.us
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  56. ledger-live-dektop-mivu.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledger-live-dektop-mivu.wasmer.app
    First seen
    2026-11-01 19:42 UTC
    First published
    2026-11-01 20:16 UTC
    DNS
    Resolves · checked 2026-11-04 20:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-01 18:42 UTC to 2027-01-30 18:42 UTC
    Logged 2026-11-01 19:40 UTC in DigiCert Sphinx2027h1, entry 330,267,184
    SHA-256 4da7e6343793e5498cfc59a2945db20848d68126cc8d7449a4c4094afa5e4217
    Public key SHA-256 1a5c6d6e35348dc7e05ee11dd902bc94d614bbbfcf0f3f41de619a7d9072ba6d
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  57. ask-ledgerlive-loginnet.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ask-ledgerlive-loginnet.wasmer.app
    First seen
    2026-11-01 13:47 UTC
    First published
    2026-11-01 14:12 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-01 12:43 UTC to 2027-01-30 12:43 UTC
    Logged 2026-11-01 13:41 UTC in Google ParcelYard2027h1, entry 556,040,793
    SHA-256 53edbbaf35d8ffec55bb7d026a3bbb491fefacd0d60a3a754e72da8c0a35b559
    Public key SHA-256 e1deea21026033ce399cdbce6be1aadc8ee0e568e978b77c739ec038101257ab
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  58. ledger-recover-support.live US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    ledger-recover-support.live
    First seen
    2026-10-31 21:41 UTC
    First published
    2026-10-31 22:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-31 20:42 UTC to 2027-01-29 20:42 UTC
    Logged 2026-10-31 21:41 UTC in DigiCert Wyvern2027h1, entry 369,408,465
    SHA-256 203c2808f0e11402d4757b25b5dfc4931b0416642a65c821559dc43b077f0d29
    Public key SHA-256 8d288eb3565dc83351f762c6c4a4384d425c9b3ed5c5a0226ce649623f56b99e
    Brand
    Ledger
    Addresses
    104.21.4.241 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.187.59 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:4f1
    2606:4700:3035::ac43:bb3b
    Cloudflare
    Cloudflare (104.21.4.241, 172.67.187.59): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledger-recover-support.live
    Registered
    2026-05-04 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  59. ledger-wallet.us.cc US · AS13335 · Cloudflare, Inc.6 addresses
    ReportedCloudflareReported by PhishDestroy
    DetailsHide
    Hostname
    ledger-wallet.us.cc
    First seen
    2026-10-31 21:41 UTC
    First published
    2026-10-31 22:45 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-31 20:40 UTC to 2027-01-29 20:40 UTC
    Logged 2026-10-31 21:39 UTC in Let's Encrypt Willow2027h1, entry 870,348,211
    SHA-256 0305b33dfc8900503fc5f1a0f0292d859b52717efebed1adf20d5eae7ad310e3
    Public key SHA-256 74b3e93c1ccd3de2dfc45348fe92c4549217e93720d12e5a3825b0eca61644d3
    PhishDestroy
    Brand
    Ledger
    Addresses
    104.26.12.42 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.26.13.42 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.68.204 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:20::681a:c2a
    2606:4700:20::681a:d2a
    2606:4700:20::ac43:44cc
    Cloudflare
    Cloudflare (104.26.12.42, 104.26.13.42, 172.67.68.204): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  60. ledger-live-app.us DE · AS24940 · HETZNER-AS Hetzner Online G…4 addresses
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    ledger-live-app.us
    First seen
    2026-10-31 18:47 UTC
    First published
    2026-10-31 19:03 UTC
    DNS
    Resolves · checked 2026-11-04 19:10 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.216.161.60.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 95.216.161.60
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-31 17:46 UTC to 2027-01-29 17:46 UTC
    Logged 2026-10-31 18:45 UTC in Google PlumbersArms2027h1, entry 543,990,901
    SHA-256 12883e72571c28919e827d3d15e03067b4f88cbbcb0a7ae3a6a7a0c8eea77a87
    Public key SHA-256 1911d1c398792cdb949af88095de7eb4c49e9b48dcd8990b578df715e8e0fb28
    Brand
    Ledger
    Addresses
    95.216.161.60 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    159.69.42.212 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    159.69.83.207 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    159.69.186.9 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (95.216.161.60, 159.69.42.212, 159.69.83.207, 159.69.186.9): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ledger-live-app.us
    Registered
    2023-07-24 · TLD Registrar Solutions Ltd.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  61. en-us-ledgerwalletlive.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    en-us-ledgerwalletlive.pages.dev
    First seen
    2026-10-31 17:36 UTC
    First published
    2026-10-31 17:58 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:11 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-31 16:34 UTC to 2027-01-29 17:33 UTC
    Logged 2026-10-31 17:34 UTC in Geomys Tuscolo2027h1, entry 422,567,293
    SHA-256 5794a8487f9bf3af207d3e2cc24d112e28a4624b4d50a9840c7e6e5119d36ec3
    Public key SHA-256 a3ea29bb20b34cc90c3da4f6d86056ff2aa2ae01083065ea406e012d362895ee
    Brand
    Ledger
    Addresses
    172.66.44.179 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.77 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cb3
    2606:4700:310c::ac42:2f4d
    Cloudflare
    Cloudflare (172.66.44.179, 172.66.47.77): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  62. www.ledger-live.com.es US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder ledger-live.com.es, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.ledger-live.com.es
    First seen
    2026-10-31 10:46 UTC
    First published
    2026-10-31 11:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · delisted on 2026-11-02
    DNS
    Resolves · checked 2026-11-04 11:10 UTC
    Listed
    MetaMask, listing ledger-live.com.es and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing RSA CA 4 · precertificate
    Valid 2026-10-31 10:35 UTC to 2027-01-29 10:44 UTC
    Logged 2026-10-31 10:45 UTC in DigiCert Wyvern2027h1, entry 366,320,742
    SHA-256 1d7c75f8fa3e106952a51bb1fede326c0c456564f60f9905c3158375d9644209
    Public key SHA-256 02037c752ec0ac5420b850db68ecabaa483fc44b8457e148ce4e6ac99e18b5cc
    Brand
    Ledger
    Addresses
    104.21.2.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:8182
    2606:4700:3035::6815:2af
    Cloudflare
    Cloudflare (104.21.2.175, 172.67.129.130): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledger-live.com.es
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  63. guide-ledger-live-app.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    guide-ledger-live-app.pages.dev
    First seen
    2026-10-31 09:11 UTC
    First published
    2026-10-31 09:25 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:35 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-31 08:10 UTC to 2027-01-29 09:07 UTC
    Logged 2026-10-31 09:10 UTC in Google PlumbersArms2027h1, entry 537,074,426
    SHA-256 2bb76ab387fd1c261ed1895e81733db43408ef4eac11c983d2835e4ddeedd8f2
    Public key SHA-256 bfe7edc7fdf6fb86e44076a587478e3d293c82ca58aa6f5dfaa3550ad4c7e4bf
    Brand
    Ledger
    Addresses
    172.66.45.28 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d1c
    2606:4700:310c::ac42:2ee4
    Cloudflare
    Cloudflare (172.66.45.28, 172.66.46.228): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  64. ledgerlive-troubleshoot-fr.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-troubleshoot-fr.wasmer.app
    First seen
    2026-10-31 09:06 UTC
    First published
    2026-10-31 09:25 UTC
    DNS
    Resolves · checked 2026-11-05 09:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-31 08:01 UTC to 2027-01-29 08:01 UTC
    Logged 2026-10-31 09:00 UTC in IPng Networks Gouda2027h1, entry 276,890,447
    SHA-256 149a1b98bf7448de8a1ab6528042ec20f2cf5ed23947d447bc0c748d30e9994e
    Public key SHA-256 7b9926be578e6f911deb693a83fbfa34b05f2ef956e6f207c6a3f61a9fc384ed
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  65. www.ledger-wallet.co.za US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder ledger-wallet.co.za, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.ledger-wallet.co.za
    First seen
    2026-10-31 08:05 UTC
    First published
    2026-10-31 08:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:32 UTC
    Listed
    MetaMask, listing ledger-wallet.co.za and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-31 07:04 UTC to 2027-01-29 08:04 UTC
    Logged 2026-10-31 08:04 UTC in Google ParcelYard2027h1, entry 535,738,289
    SHA-256 40c275c4727ccef575681ed891754918f2250c1ef5bf24d3a00591440479667e
    Public key SHA-256 99ce98d4fad4bb87d1c795d266a2da8041c941f1f1c761bdefc84632f530a933
    Brand
    Ledger
    Addresses
    104.21.2.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:8182
    2606:4700:3035::6815:2af
    Cloudflare
    Cloudflare (104.21.2.175, 172.67.129.130): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledger-wallet.co.za
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  66. www.ledgerlive.com.es US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder ledgerlive.com.es, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.ledgerlive.com.es
    First seen
    2026-10-31 07:10 UTC
    First published
    2026-10-31 07:17 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · delisted on 2026-11-02
    DNS
    Resolves · checked 2026-11-05 07:22 UTC
    Listed
    MetaMask, listing ledgerlive.com.es and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-10-31 06:57 UTC to 2027-01-29 07:05 UTC
    Logged 2026-10-31 07:07 UTC in DigiCert Wyvern2027h1, entry 365,482,946
    SHA-256 3216088e28d22674f32424bb93731cddd113b62b1ba9a85f155afb9bec71b739
    Public key SHA-256 95093baaeba75cca0ad7fc8a5b4f3752cd91e3274adadc6b6246ca346d887701
    Brand
    Ledger
    Addresses
    104.21.2.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:8182
    2606:4700:3035::6815:2af
    Cloudflare
    Cloudflare (104.21.2.175, 172.67.129.130): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledgerlive.com.es
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  67. ledger-i--login.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-i--login.pages.dev
    First seen
    2026-10-31 06:26 UTC
    First published
    2026-10-31 07:17 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:22 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-31 05:21 UTC to 2027-01-29 06:20 UTC
    Logged 2026-10-31 06:21 UTC in Let's Encrypt Sycamore2027h1, entry 867,216,182
    SHA-256 045158fad90f4177b74f0197635bdf6f826c4eabd941829cfe8010ef8c9498c1
    Public key SHA-256 a49e64d7bf7b45be42aa7739effd82c967fbb104051215a585efcc23b0e1d089
    Brand
    Ledger
    Addresses
    172.66.44.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.3 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cfd
    2606:4700:310c::ac42:2f03
    Cloudflare
    Cloudflare (172.66.44.253, 172.66.47.3): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  68. ledger--live-app.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger--live-app.pages.dev
    First seen
    2026-10-31 04:51 UTC
    First published
    2026-10-31 05:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:18 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-31 03:51 UTC to 2027-01-29 04:48 UTC
    Logged 2026-10-31 04:51 UTC in Google PlumbersArms2027h1, entry 534,329,413
    SHA-256 83bc37f79f8abcff069eb373cbe11bd6107e645d0a768cbb1fcfada976ec0593
    Public key SHA-256 3dd0e508c828a80b6bb6e21bc0ffdc8adf9f002445a60a15ddbe445d029bc85b
    Brand
    Ledger
    Addresses
    172.66.44.217 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cd9
    2606:4700:310c::ac42:2f27
    Cloudflare
    Cloudflare (172.66.44.217, 172.66.47.39): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  69. desktoop-ledger-live.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    desktoop-ledger-live.pages.dev
    First seen
    2026-10-31 02:26 UTC
    First published
    2026-10-31 02:53 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-10-31 00:00 UTC to 2027-01-13 12:37 UTC
    Logged 2026-10-31 02:23 UTC in Geomys Tuscolo2027h1, entry 414,782,589
    SHA-256 30a80f4bc5c42277f358b8fd694b5e5303c93b901896b0b7ccb03f87baa3d051
    Public key SHA-256 6a55ca5d06eeedf383cc819984a14b83c3139a3063909d628f8837d48dcb44a0
    Brand
    Ledger
    Addresses
    172.66.45.35 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d23
    2606:4700:310c::ac42:2edd
    Cloudflare
    Cloudflare (172.66.45.35, 172.66.46.221): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  70. ledger-bitcoin-recovery-wallet.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    ledger-bitcoin-recovery-wallet.com
    First seen
    2026-10-31 02:21 UTC
    First published
    2026-10-31 02:53 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-10-31 00:00 UTC to 2027-01-13 19:04 UTC
    Logged 2026-10-31 02:19 UTC in Let's Encrypt Willow2027h1, entry 858,190,251
    SHA-256 ddb24bee3bd9df07ac247b571fb4f74c0352953fc75a326e718372221cc15a4c
    Public key SHA-256 df3a1eb4cb170ed97f461a404ee3633ad345bfb54d7dc2143e9bc0e4af9a3e34
    PhishDestroy
    Brand
    Ledger
    Addresses
    104.21.62.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.168.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:3e8b
    2606:4700:3037::ac43:a85b
    Cloudflare
    Cloudflare (104.21.62.139, 172.67.168.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledger-bitcoin-recovery-wallet.com
    Registered
    2026-02-17 · Hello Internet Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  71. ledger-recovery-en.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledger-recovery-en.wasmer.app
    First seen
    2026-10-31 00:37 UTC
    First published
    2026-10-31 00:45 UTC
    DNS
    Resolves · checked 2026-11-05 00:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-30 23:36 UTC to 2027-01-28 23:36 UTC
    Logged 2026-10-31 00:34 UTC in Google PlumbersArms2027h1, entry 531,703,230
    SHA-256 330e5c79c6ef3abb2b47ce7deae2903342e72aae7dd8b1f88a002d64c25660c6
    Public key SHA-256 62e3ddc3e9c1b37eed8ec6dcd4206a2fe5b1ef4d84abe9d5f3ddbd0746feb8a7
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  72. ledger----login.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger----login.pages.dev
    First seen
    2026-10-30 21:11 UTC
    First published
    2026-10-30 21:47 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 21:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 20:05 UTC to 2027-01-28 21:04 UTC
    Logged 2026-10-30 21:05 UTC in Google PlumbersArms2027h1, entry 529,284,516
    SHA-256 11c90abba8e9c1b0136648d1787d50e1868652a53c220a7740f95ee9c5ea294b
    Public key SHA-256 496406403ab920d46b0d44900d43056a485da9502d49c74aa284af00bb45fb60
    Brand
    Ledger
    Addresses
    172.66.44.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.6 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cfa
    2606:4700:310c::ac42:2f06
    Cloudflare
    Cloudflare (172.66.44.250, 172.66.47.6): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  73. ledger-live-en-hellp.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-en-hellp.pages.dev
    First seen
    2026-10-30 20:21 UTC
    First published
    2026-10-30 20:43 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 20:47 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 19:19 UTC to 2027-01-28 20:18 UTC
    Logged 2026-10-30 20:19 UTC in Google ParcelYard2027h1, entry 528,118,769
    SHA-256 963e0f68de4444d5e1584a869223b09847297a1c744895fb973265eb9a1cc22b
    Public key SHA-256 af211c0c098346fbae93727c1f99613cfd08abace9172fb3874d519d494e0e27
    Brand
    Ledger
    Addresses
    172.66.44.114 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.142 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c72
    2606:4700:310c::ac42:2f8e
    Cloudflare
    Cloudflare (172.66.44.114, 172.66.47.142): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  74. ledger-verification8-en.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledger-verification8-en.wasmer.app
    First seen
    2026-10-30 18:56 UTC
    First published
    2026-10-30 19:10 UTC
    DNS
    Resolves · checked 2026-11-04 19:15 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-30 17:53 UTC to 2027-01-28 17:53 UTC
    Logged 2026-10-30 18:52 UTC in Geomys Tuscolo2027h1, entry 410,950,634
    SHA-256 1b09fc7f3c0d01958c8acc12fbc01689c78d9bcc1c9e06933a5964a1ece42584
    Public key SHA-256 9ad8805c5bbf9789a96eeb14e88bc6f449ff2de57a1679cf2baeec379b44411a
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  75. app-en-ledger-live.com US · AS54290 · Hostwinds LLC.
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    app-en-ledger-live.com
    First seen
    2026-10-30 17:56 UTC
    First published
    2026-10-30 18:07 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:13 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 142.11.252.73.
    1. Phishing-host list fetched with the address
    2. Resolved to 142.11.252.73
    3. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-30 16:52 UTC to 2027-01-28 16:52 UTC
    Logged 2026-10-30 17:51 UTC in Google PlumbersArms2027h1, entry 527,010,897
    SHA-256 70ccb358a8b559a450dec99fd66adc5cde4b115c7086c50017af1f474d088799
    Public key SHA-256 19e1b34f1233f5a75588d5f370955e4884dec9f1e4ed019e313180827c87586f
    Brand
    Ledger
    Addresses
    142.11.252.73 · United States · AS54290 HOSTWINDS - Hostwinds LLC.
    Domain
    app-en-ledger-live.com
    Registered
    2026-08-27 · eNom, LLC
    MX
    Receives mail at app-en-ledger-live.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  76. ledger-login-live.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-login-live.pages.dev
    First seen
    2026-10-30 12:15 UTC
    First published
    2026-10-30 12:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 11:14 UTC to 2027-01-28 12:12 UTC
    Logged 2026-10-30 12:14 UTC in Google PlumbersArms2027h1, entry 522,933,387
    SHA-256 295308f1866bf55245fd31fc9fc02b12455894b89636825e3cd592058a199180
    Public key SHA-256 4a5604e1c7baaf8f89082bd3d9835369eb3ac0f573dbc46059a2628b380a8adc
    Brand
    Ledger
    Addresses
    172.66.44.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.92 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2ca4
    2606:4700:310c::ac42:2f5c
    Cloudflare
    Cloudflare (172.66.44.164, 172.66.47.92): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  77. ledger-live-homeorglog.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledger-live-homeorglog.wasmer.app
    First seen
    2026-10-30 11:52 UTC
    First published
    2026-10-30 12:50 UTC
    DNS
    Resolves · checked 2026-11-04 13:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-30 10:50 UTC to 2027-01-28 10:50 UTC
    Logged 2026-10-30 11:48 UTC in DigiCert Wyvern2027h1, entry 360,128,989
    SHA-256 031d3b87341a85513afe3088e1b26b414d14e6513257269168fd026b87f0b992
    Public key SHA-256 c507732f05cdbe4fa2151948b632b7a1863540568eeb8036e1d01cd8dc7b0ec0
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  78. ledgerlive-downloads.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledgerlive-downloads.pages.dev
    First seen
    2026-10-30 08:05 UTC
    First published
    2026-10-30 08:40 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 07:02 UTC to 2027-01-28 08:01 UTC
    Logged 2026-10-30 08:02 UTC in Let's Encrypt Sycamore2027h1, entry 852,391,688
    SHA-256 f59880656ffc078b9e5c848c9c026c594a7b86d6d304c51bbb152872ad17a4a1
    Public key SHA-256 1fa11b75e522de0c8fbbadc5fc9da9ce1ccd6a363d4917c089e88e50e15d6458
    Brand
    Ledger
    Addresses
    172.66.44.144 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c90
    2606:4700:310c::ac42:2f70
    Cloudflare
    Cloudflare (172.66.44.144, 172.66.47.112): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  79. get-ledgerlive-en.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    get-ledgerlive-en.pages.dev
    First seen
    2026-10-30 02:31 UTC
    First published
    2026-10-30 02:55 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:03 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 01:27 UTC to 2027-01-28 02:25 UTC
    Logged 2026-10-30 02:27 UTC in IPng Networks Gouda2027h1, entry 265,752,710
    SHA-256 0715ef1a6e3ff5b62afd6abac12254299486c82098a58cb3886ca8db67cbac8e
    Public key SHA-256 e0838f812fb052936468fd3509287e86de10134f942a0d3f8a952fa11abc5ace
    Brand
    Ledger
    Addresses
    172.66.44.144 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c90
    2606:4700:310c::ac42:2f70
    Cloudflare
    Cloudflare (172.66.44.144, 172.66.47.112): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  80. app--ledgerlive---en.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    app--ledgerlive---en.pages.dev
    First seen
    2026-10-29 21:21 UTC
    First published
    2026-10-29 21:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 21:45 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-29 20:17 UTC to 2027-01-27 21:13 UTC
    Logged 2026-10-29 21:17 UTC in DigiCert Wyvern2027h1, entry 352,265,240
    SHA-256 7a928df995c7685b00904f5f08955e760a182a798fb963995377a5b2ad576a95
    Public key SHA-256 55f31dbfd71426c3b1e35324ae1a43ee6478c06248974ede01c4dbb6c3cb5ee3
    Brand
    Ledger
    Addresses
    172.66.44.129 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.127 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c81
    2606:4700:310c::ac42:2f7f
    Cloudflare
    Cloudflare (172.66.44.129, 172.66.47.127): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  81. ledger-live-downloads.io
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    ledger-live-downloads.io
    First seen
    2026-10-29 16:36 UTC
    First published
    2026-10-29 17:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-10-29 · checked 2026-11-04 17:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-29 15:36 UTC to 2027-01-27 15:36 UTC
    Logged 2026-10-29 16:34 UTC in Google ParcelYard2027h1, entry 508,804,673
    SHA-256 15a5f8d57c0f194e016ca7cc86ba893cb8a39c9c2ca570c4f8044d15a4a9e0f1
    Public key SHA-256 7e4fd4cd0ed066ce2c62a4387f51eab04a863dd7dbd337a104867cd34f91dd1a
    Brand
    Ledger
    Domain
    ledger-live-downloads.io
    Registered
    2026-04-16 · TLD Registrar Solutions Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  82. ledger-live-app.io
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    ledger-live-app.io
    First seen
    2026-10-29 12:06 UTC
    First published
    2026-10-29 12:13 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-10-29 · checked 2026-11-04 12:22 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 11:01 UTC to 2027-01-27 11:01 UTC
    Logged 2026-10-29 12:00 UTC in Let's Encrypt Willow2027h1, entry 832,050,835
    SHA-256 72b4b10fdaacd0bb719019ee15e8dbd48c07ddc388edb0b6981a8b4864e6ba17
    Public key SHA-256 f519975f3399aa7c31b443f13d986700200e3a057ff1bc9a350c710bd4fd1723
    Brand
    Ledger
    Domain
    ledger-live-app.io
    Registered
    2026-04-16 · TLD Registrar Solutions Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:35 UTC

    Suggest a correction

  83. migolive.ledger-wallet.biz DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under ledger-wallet.biz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    migolive.ledger-wallet.biz
    First seen
    2026-10-29 09:46 UTC
    First published
    2026-10-29 09:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:02 UTC
    Listed
    MetaMask, listing ledger-wallet.biz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-29 08:45 UTC to 2027-01-27 08:45 UTC
    Logged 2026-10-29 09:44 UTC in Google PlumbersArms2027h1, entry 504,158,921
    SHA-256 ba2f5a01c43d7e639c42eb3ece7211b115ffb6f510bb2c65e245f2bd2f6aa448
    Public key SHA-256 42d45f591a2666901fc94fa789f61aca73051d2196bf23a50c2a5ae54dbdc8f3
    Brand
    Ledger
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    ledger-wallet.biz
    Registered
    2026-05-30 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  84. e4d2qxltl4.ledgerlive.ind.in DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under ledgerlive.ind.in, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    e4d2qxltl4.ledgerlive.ind.in
    First seen
    2026-10-29 08:25 UTC
    First published
    2026-10-29 08:49 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask, listing ledgerlive.ind.in and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 07:23 UTC to 2027-01-27 07:23 UTC
    Logged 2026-10-29 08:22 UTC in DigiCert Wyvern2027h1, entry 345,112,106
    SHA-256 12cfdb3e9337ecd1d5a5746980050f30fbbc598364a69d1fea0de1f64b24f0da
    Public key SHA-256 572690400b50e93922f3867175707a7bf4766ec2b3099193e5f182c6d2cb0443
    Brand
    Ledger
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    ledgerlive.ind.in
    Registered
    2026-05-10 · Hosting Concepts B.V. dba Openprovider
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  85. welcome-sos-ledger-wallet.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    welcome-sos-ledger-wallet.pages.dev
    First seen
    2026-10-29 08:25 UTC
    First published
    2026-10-29 08:49 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:05 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-29 07:21 UTC to 2027-01-27 08:19 UTC
    Logged 2026-10-29 08:21 UTC in DigiCert Wyvern2027h1, entry 345,101,120
    SHA-256 1ad3db279c833296efcccc61390865aedff2f9aae15dd2e2b21f1e619fbf8270
    Public key SHA-256 9fed4cb137c99f67024cbb1d0fc24b61cab26bd903ff78dc47eeb96f55c9396d
    Brand
    Ledger
    Addresses
    172.66.44.246 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cf6
    2606:4700:310c::ac42:2f0a
    Cloudflare
    Cloudflare (172.66.44.246, 172.66.47.10): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  86. get-alone-ledger-wallet.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    get-alone-ledger-wallet.pages.dev
    First seen
    2026-10-29 04:30 UTC
    First published
    2026-10-29 04:38 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 04:50 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-29 03:27 UTC to 2027-01-27 04:24 UTC
    Logged 2026-10-29 04:27 UTC in DigiCert Sphinx2027h1, entry 302,003,378
    SHA-256 61978e9b70b9db43441b0222467dbaf22bd21123cc31b42dbe5bd8e13e7904a0
    Public key SHA-256 6dc6d59d950baff193fe25a2525e54b5731c571026de28dce3bad97e5e6297f9
    Brand
    Ledger
    Addresses
    172.66.44.129 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.127 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c81
    2606:4700:310c::ac42:2f7f
    Cloudflare
    Cloudflare (172.66.44.129, 172.66.47.127): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  87. panel.my-ledgerlive.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under my-ledgerlive.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    panel.my-ledgerlive.com
    First seen
    2026-10-28 23:51 UTC
    First published
    2026-10-29 00:30 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:41 UTC
    Reported
    PhishDestroy, listing my-ledgerlive.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-28 22:51 UTC to 2027-01-26 22:51 UTC
    Logged 2026-10-28 23:50 UTC in IPng Networks Halloumi2027h1, entry 294,423,603
    SHA-256 9424cd2ca3832a6d4139f4d5783c4c59344d8973c9e4d8fc705f8ee5680b6df0
    Public key SHA-256 3efd007c31a06353024a1f2856d3d9a7e7bd31c1df0f33ebd41dbe7911d26e23
    PhishDestroy
    Brand
    Ledger
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    my-ledgerlive.com
    Registered
    2026-02-05 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  88. ledger-live-faq.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-faq.pages.dev
    First seen
    2026-10-28 22:21 UTC
    First published
    2026-10-28 22:27 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:41 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-28 21:19 UTC to 2027-01-26 22:17 UTC
    Logged 2026-10-28 22:19 UTC in Geomys Tuscolo2027h1, entry 387,381,418
    SHA-256 63d6f9a4bcbbe028f1eb6fefba1144a9d2bc297fa1cfed187e332ae94d28de28
    Public key SHA-256 ae215e3a908077310db76f5ce85f9e397f4f2f3c98ed6c6597cb863957cdc9ff
    Brand
    Ledger
    Addresses
    172.66.44.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.180 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c4c
    2606:4700:310c::ac42:2fb4
    Cloudflare
    Cloudflare (172.66.44.76, 172.66.47.180): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  89. ledger--wallet--welcome.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger--wallet--welcome.pages.dev
    First seen
    2026-10-28 22:16 UTC
    First published
    2026-10-28 22:27 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:41 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-28 21:13 UTC to 2027-01-26 21:13 UTC
    Logged 2026-10-28 22:12 UTC in DigiCert Sphinx2027h1, entry 299,124,833
    SHA-256 970dc700b0f8b9b5d800d667fb9649e765a92b3bdda80351c00739706caaaf7f
    Public key SHA-256 f7a44b32050dad8213be097386ca5d2abd6c15e53689ea6140c0dd3970d78351
    Brand
    Ledger
    Addresses
    172.66.44.110 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.146 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c6e
    2606:4700:310c::ac42:2f92
    Cloudflare
    Cloudflare (172.66.44.110, 172.66.47.146): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  90. v1-ledgerlive.org US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    v1-ledgerlive.org
    First seen
    2026-10-28 21:51 UTC
    First published
    2026-10-28 22:27 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:41 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-28 20:48 UTC to 2027-01-26 20:48 UTC
    Logged 2026-10-28 21:46 UTC in Google ParcelYard2027h1, entry 495,335,690
    SHA-256 8c22d8a7ac1ada8c1d44c2e255863181ba302a8ee67e3b3ad148ec58297aee27
    Public key SHA-256 1757ea67d7bf82ba0af53cab691bdc84eb2a98b5633ddc094c3461d99507590b
    Brand
    Ledger
    Addresses
    104.21.23.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.209.223 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:1759
    2606:4700:3033::ac43:d1df
    Cloudflare
    Cloudflare (104.21.23.89, 172.67.209.223): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v1-ledgerlive.org
    Registered
    2026-08-06 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:05 UTC

    Suggest a correction

  91. dxrcp4gv.my-ledgerlive.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under my-ledgerlive.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    dxrcp4gv.my-ledgerlive.com
    First seen
    2026-10-28 21:46 UTC
    First published
    2026-10-28 22:27 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:41 UTC
    Reported
    PhishDestroy, listing my-ledgerlive.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-28 20:44 UTC to 2027-01-26 20:44 UTC
    Logged 2026-10-28 21:42 UTC in Google PlumbersArms2027h1, entry 495,970,635
    SHA-256 88c9d3e93dcea8f1ba5a9d9d5ce06aee23470394e9b50f8dc5999e0aa0ad3dff
    Public key SHA-256 3efd007c31a06353024a1f2856d3d9a7e7bd31c1df0f33ebd41dbe7911d26e23
    PhishDestroy
    Brand
    Ledger
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    my-ledgerlive.com
    Registered
    2026-02-05 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  92. ledger-live-start-cmt.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-start-cmt.pages.dev
    First seen
    2026-10-28 19:56 UTC
    First published
    2026-10-28 20:22 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 20:30 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-28 18:54 UTC to 2027-01-26 19:52 UTC
    Logged 2026-10-28 19:54 UTC in Geomys Tuscolo2027h1, entry 386,038,005
    SHA-256 351bfec49e26dd6d3d392c3a8334d99f04dd57a1cfe6df7adb12508407ebd537
    Public key SHA-256 fb6ab91f0c29319bc4a275edc66f3313b5eb32acebe604e3a65971ce9efce5ea
    Brand
    Ledger
    Addresses
    172.66.44.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.3 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cfd
    2606:4700:310c::ac42:2f03
    Cloudflare
    Cloudflare (172.66.44.253, 172.66.47.3): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  93. ledger-live-cloud.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-live-cloud.pages.dev
    First seen
    2026-10-28 19:52 UTC
    First published
    2026-10-28 20:22 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 20:30 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-28 18:48 UTC to 2027-01-26 19:46 UTC
    Logged 2026-10-28 19:48 UTC in DigiCert Wyvern2027h1, entry 338,285,822
    SHA-256 0689cdc8219b2aea1a76e4cdc25fdff8d91ddbf7ddd2be502b3e05558674dbff
    Public key SHA-256 9a0985dd07d2bad9ed8c6f66a9dad418739c6d95a12a794870043c6f18398047
    Brand
    Ledger
    Addresses
    172.66.44.252 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.4 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cfc
    2606:4700:310c::ac42:2f04
    Cloudflare
    Cloudflare (172.66.44.252, 172.66.47.4): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  94. ledgerlive-updates-ae.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    ledgerlive-updates-ae.wasmer.app
    First seen
    2026-10-28 19:00 UTC
    First published
    2026-10-28 19:20 UTC
    DNS
    Resolves · checked 2026-11-04 19:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-28 17:59 UTC to 2027-01-26 17:59 UTC
    Logged 2026-10-28 18:58 UTC in Google ParcelYard2027h1, entry 493,316,044
    SHA-256 d44fc7931961031c9ad89f2305fc9e5589aa04252ca1c9ba30d13c8fc70e314a
    Public key SHA-256 ae9dc142207ff98557cbb952cc5d061169969ff158afad5c1f64bef750915d21
    Brand
    Ledger
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Ledger when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Crypto & web3

All brands →