max-ledger[.]live

Analysis of the domain max-ledger.live confirms it as a high-risk crypto scam impersonating Ledger, a hardware wallet provider. The domain was registered on October 13, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu and resolved to the IP address 45.82.82.240, hosted on AS9123 JSC TIMEWEB in Russia. No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'Ledger Live App – Download & Setup Desktop & Mobile App,' directly mimics Ledger’s official software, indicating an intent to deceive users into downloading malicious applications or disclosing sensitive credentials.

The domain is flagged by 13 of 95 security vendors on VirusTotal and appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Nameservers a.dnspod.com and c.dnspod.com are associated with the domain, though their direct involvement in malicious activity remains unconfirmed. As of July 23, 2026, the domain has been taken offline, but defenders should treat any residual DNS records or cached pages as compromised. The absence of an SSL certificate and the use of Russian-hosted infrastructure further align with known patterns of crypto-focused phishing campaigns.

No evidence of a specific phishing kit or additional malicious payloads has been identified in the available data. The exact content of the site beyond the page title remains unanalyzed, but the combination of brand impersonation, crypto scam classification, and detection by multiple vendors confirms its malicious intent. Organizations should block the domain at the DNS level, monitor for related IOCs (e.g., 45.82.82.240, associated nameservers), and alert users to the risk of fraudulent Ledger-themed downloads.