download-ledger[.]co[.]com

Analysis of download-ledger.co.com confirms it is a high-risk phishing domain impersonating Ledger, a cryptocurrency hardware wallet provider. The domain was registered through Moniker Online Services LLC on August 16, 1997, though this creation date predates modern phishing infrastructure and may reflect domain resale or registry manipulation. As of July 23, 2026, the domain is offline, but prior infrastructure reveals it resolved to IP 45.82.82.240, hosted on AS9123 JSC TIMEWEB in Russia. No SSL certificate was detected, increasing the risk of unencrypted data interception.

The page title, 'Ledger Live App – Download & Setup Desktop & Mobile App,' directly mimics Ledger’s official software distribution, indicating intent to deceive users into downloading malicious wallet applications. Security vendor assessments reinforce the malicious classification: Gridinsoft assigned a trust score of 0/100, Scamadviser rated it 1/100, and the domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Twelve of 95 security vendors on VirusTotal flagged the domain at the time of scanning. Nameservers ns1.nic.co.com through ns4.nic.co.com suggest a structured, potentially automated domain registration pattern commonly observed in phishing campaigns.

While the exact content of the site remains unanalyzed, the combination of brand impersonation, crypto-focused deception, and low trust scores confirms the domain’s role in a cryptocurrency scam. Defenders should treat this domain as malicious and block it at DNS, firewall, and endpoint levels. Organizations using Ledger products should alert users to verify official download sources and monitor for similar impersonation domains using the 'ledger' keyword in subdomains or paths. Given the domain’s current offline status, further forensic analysis may be limited, but historical infrastructure data provides sufficient evidence for remediation.