desktop-ldgerlive--homepage[.]created[.]app

desktop-ldgerlive--homepage.created.app is flagged as a brand‑impersonation site targeting Ledger users. The domain was registered through Tucows Domains Inc. on 12 July 2023 and resolves to IP address 216.150.1.193, which is owned by Amazon.com, Inc. (AS16509) and geolocated in the United States. DNS resolution uses Vercel’s authoritative nameservers (ns1.vercel‑dns.com, ns2.vercel‑dns.com), and the site serves an HTTPS certificate from Let’s Encrypt issued under the R13 automation pipeline, indicating a valid TLS configuration with HSTS enabled. The page title returned by the server reads “Ledger Live Desktop — Official Software for Hardware Wallet Users,” directly referencing Ledger’s official desktop client, which aligns with the reported brand‑target of Ledger and the classification as a crypto‑related scam.

VirusTotal analysis shows that six of ninety‑five scanning engines have flagged the domain, providing independent confirmation of malicious intent. The site is listed on at least one public blocklist and has been actively blocked by the PhishDestroy network. An HTTP request to the root URL returns a 404 status, and the current operational status is offline, suggesting the hosting has been taken down or is temporarily unavailable. Detected technologies include Vercel’s hosting platform and HTTP Strict Transport Security, both consistent with the DNS configuration.

Evidence gaps remain: no live content was captured, the exact phishing or credential‑harvesting mechanisms have not been observed, and the specific payload or redirect behavior is unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for re‑hosting attempts on other Vercel or cloud providers, and update endpoint protection signatures to reflect the six VirusTotal detections. Incident response teams investigating Ledger‑related compromise should treat any traffic to this domain as malicious and advise users to avoid downloading software from the URL.