apps-ledger[.]live

apps-ledger.live is a recently observed credential harvesting site that impersonates Ledger’s official “Ledger Live” application. The domain was registered on 13 October 2025 through Hosting Concepts B.V. operating under the Registrar.eu brand. DNS resolution points to the IPv4 address 45.82.82.240, which is announced by AS9123 JSC TIMEWEB and geolocated to Russia. Authoritative name servers are a.dnspod.com and c.dnspod.com, both associated with the DNSPod service.

No HTTPS certificate is presented; the site serves only HTTP, indicating a lack of transport‑level security. The page title returned by the HTTP response is “Ledger Live App – Download & Setup Desktop & Mobile App”, directly referencing Ledger’s product suite and reinforcing the impersonation claim. The site is classified as a crypto‑related scam, specifically targeting Ledger users, and has been listed on four public blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura). VirusTotal analysis shows that 13 out of 95 scanning engines flagged the domain, corroborating its malicious reputation.

As of the report date (23 July 2026) the domain is reported offline, which may be a temporary takedown or an evasion tactic. No SSL certificate, no additional metadata, and no sample payloads have been publicly disclosed, leaving the exact phishing workflow unknown. Defenders should continue to block the domain and its hosting IP at perimeter firewalls, update URL filtering and threat intel feeds, and monitor for any re‑registration or similar domains leveraging the “apps‑ledger” keyword pattern. Continuous observation of the associated IP range and DNS changes is recommended, as the infrastructure could be reused for future Ledger‑related impersonation campaigns.