app[.]ledger-live-application[.]io

Analysis indicates that the domain app.ledger-live-application.io is currently active and is being used for a brand‑impersonation campaign targeting Ledger users. The site presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier YE1) and responds with an HTTP 302 redirect, which is typical of phishing infrastructure that forwards victims to a malicious landing page. DNS resolution points to IP 193.24.123.182, which is registered to Prospero OOO in Russia. The IP address appears on one security blocklist and the domain is listed by PhishDestroy. VirusTotal scans show that 16 of 91 security vendors have flagged the domain as malicious, reinforcing the suspicion of abuse. The campaign’s risk level is assessed as high, and the unique seed 9df966 ties this observation to existing intelligence records. No additional content analysis (page title, HTML, or login form) is available, so the exact visual spoofing techniques remain unverified. Defenders should immediately block both the domain and the associated IP address at perimeter and DNS layers, ensure that endpoint protection solutions ingest the VirusTotal detection count, and monitor for any outbound connections to the IP. Continuous threat‑intel feeds should be consulted for potential reuse of the same IP by related campaigns, and any credential‑stealing activity targeting Ledger accounts should be investigated. Organizations employing Ledger hardware wallets should reinforce user awareness, reminding users that legitimate Ledger services never use sub‑domains such as “ledger‑live‑application.io” and that TLS certificates from Let’s Encrypt do not guarantee authenticity.