ledgerr-live[.]org

On July 23, 2026, the domain ledgerr-live.org was identified as part of a wallet/seed phishing campaign that impersonates Ledger’s services. The site was created on February 21, 2026 and is currently taken offline. The page title returned by the HTTP response was “Ledger Live Desktop App – Download the Latest Ledger Live Software,” which directly references the target brand. The domain is registered through Web Commerce Communications Limited dba WebNic.cc. DNS resolution points to the single IPv4 address 172.67.216.145, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States.

An SSL certificate labeled WE1 was observed, indicating a valid TLS endpoint despite the malicious intent. The infrastructure has been flagged by multiple threat‑intelligence sources. PhishDestroy has added the domain to its blocklist, and the domain appears on one additional security blocklist. VirusTotal scans show that 18 of 93 security vendors returned a detection for the domain, reinforcing the malicious classification. Independent trust scoring from Gridinsoft assigned a score of 0 out of 100, the lowest possible rating.

Analysis indicates that the site was used to lure victims into providing cryptocurrency wallet credentials or seed phrases, consistent with the described wallet/seed phishing vector. No further technical artifacts such as malicious payloads, command‑and‑control endpoints, or redirects have been publicly disclosed, leaving the full operational details uncertain. Defenders should block connections to 172.67.216.145 and add ledgerr-live.org to URL filtering rules. Monitoring for new domains registered through the same registrar or for similar page titles is recommended, as the attacker may reuse the same template. Continuous re‑scanning of the domain and its IP on VirusTotal and other multi‑engine platforms is advised to capture any changes in detection status.