start-ledger[.]live

Analysis of start-ledger.live indicates a high‑risk brand‑impersonation campaign targeting Ledger users. The domain was registered on July 01, 2023 and presently resolves to the IPv4 address 144.31.194.100, which is allocated to AS199785‑DE‑iPv4 operated by Cloud Hosting Solutions, Limited in Germany. No TLS certificate is presented, and the site is currently taken offline, limiting immediate interaction but leaving historical artifacts for forensic review. The page title returned by the server is “Ledger Live App – Download & Setup Desktop & Mobile App”, directly referencing Ledger’s official software and confirming the intent to masquerade as a legitimate Ledger download portal. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion.

VirusTotal records 16 of 95 scanning engines flagging the domain, corroborating malicious intent. The domain is listed on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among community‑driven security feeds. Nameserver configuration uses the dnspod.com pool (a.dnspod.com, b.dnspod.com, c.dnspod.com), a common choice for rapidly provisioned malicious infrastructure. The campaign is classified as a crypto scam, with the threat actor explicitly impersonating Ledger to lure victims into downloading fraudulent software or disclosing credentials.

Uncertainty remains regarding the exact payload delivered, the presence of additional command‑and‑control endpoints, and any post‑compromise activity, as no further forensic details have been disclosed. Defenders should block the IP 144.31.194.100 and the domain start-ledger.live at DNS and firewall layers, update IDS signatures to include the observed page title and the four blocklist identifiers, and monitor for anomalous traffic to the AS199785 network that may indicate related campaigns. Continuous re‑scanning of the domain, even after takedown, is advised to capture any re‑hosting attempts.