ledger-live-download[.]org

The domain ledger-live-download.org is under investigation for brand impersonation, specifically targeting Ledger. This domain is active and has not been flagged by major security services. There is no evidence of a drainer kit being used, but the domain's infrastructure and content suggest a phishing campaign designed to deceive users into downloading malicious software or providing sensitive information.

Infrastructure analysis reveals that the domain ledger-live-download.org resolves to the IP address 103.224.182.253. The domain was registered through Spaceship, Inc. on December 28, 2024. The SSL certificate is issued by Let's Encrypt, which is a common tactic used by threat actors to appear more legitimate. The domain has a VirusTotal detection count of 0/95, indicating that it has not yet been identified as malicious by most security engines. It is not listed in Google Safe Browsing (GSB) or any major blocklists, which further suggests that it is a newly active threat.

The current status of the domain is active, and it continues to impersonate Ledger. Response actions should include monitoring the domain for changes in content or infrastructure, and notifying Ledger of the impersonation to allow them to take appropriate measures. Users should be cautious when encountering this domain and should verify the authenticity of any download links or requests for sensitive information. The risk level is currently under investigation, and further analysis is required to determine the full scope of the threat and potential impact.