downloadledgerlive[.]created[.]app

downloadledgerlive.created.app was observed hosting a page titled “Download Ledger Live | Connect Your Ledger”. The page title explicitly references Ledger, confirming a brand‑impersonation attempt targeting Ledger users. The domain resolves to the IP address 216.150.1.1, which belongs to Amazon.com, Inc. (ASN 16509) and is geolocated in the United States. Infrastructure analysis shows the domain is served from Vercel’s hosting platform; DNS is delegated to ns1.vercel‑dns.com and ns2.vercel‑dns.com, and the site presents an HSTS header, indicating HTTPS‑only enforcement. The TLS certificate is issued by Let’s Encrypt under the R13 issuance, a standard free certificate.

Registration data reveals the domain was created on 12 July 2023 through Tucows Domains Inc., a registrar frequently used for disposable or short‑lived malicious sites. The domain is currently marked as offline and returns an HTTP 404 status, which suggests the malicious content has been removed or the site has been taken down. Despite being offline, the domain appears on at least one security blocklist – PhishDestroy – and is listed in a public security blocklist used by many protection products. VirusTotal scans show that six of ninety‑five antivirus or URL‑reputation engines flagged the domain as malicious, providing additional corroboration of its malicious intent.

The observed scam type is classified as a crypto scam, consistent with the Ledger brand impersonation. No additional intelligence such as Safe Browsing or OTX references is available in the supplied data. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration or similar sub‑domains using the same brand terms, and consider adding the IP address 216.150.1.1 to host‑based blocklists if not already covered.