ledger-live-desktop-apps[.]com

This domain is flagged for elevated risk due to brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The threat involves distributing counterfeit desktop applications under the guise of legitimate Ledger Live software, likely to harvest credentials or deploy malware on victim systems. Analysis indicates the domain was registered on June 12, 2026, through Hello Internet Corp. It resolves to the IP address 188.114.97.3 and is currently offline. VirusTotal reports 11 out of 95 security vendors flagging this domain as malicious. The domain appears on one security blocklist and was previously blocked by a threat intelligence feed. Detected technologies include Cloudflare, Cloudflare Browser Insights, and HTTP/3, suggesting the use of content delivery networks to obfuscate infrastructure. Mitigation steps for this brand impersonation threat include blocking the domain and its associated IP (188.114.97.3) at the network perimeter. Organizations should monitor for connections to this IP or domain in logs and alert on any attempts to access it. End users should be educated to verify the authenticity of Ledger software by downloading only from the official ledger.com domain. Cryptographic signature verification of downloaded binaries is recommended to detect tampering. Network defenders should also monitor for other domains registered through Hello Internet Corp with similar naming patterns, as this registrar may be abused for further impersonation campaigns.