ledgelvedownload[.]created[.]app

The domain ledgelvedownload.created.app has been identified as a brand impersonation threat specifically targeting Ledger, a provider of cryptocurrency hardware wallets. This domain is currently offline but was actively used to distribute fraudulent versions of Ledger Live, the official wallet management software. The threat type is classified as brand impersonation, designed to deceive users into downloading malicious software under the guise of legitimate cryptocurrency tools. Analysis indicates that ledgelvedownload.created.app was flagged by 17 of 95 security vendors on VirusTotal, reflecting a significant detection rate. The domain was registered through Tucows Domains Inc. on July 12, 2023, and resolved to the IP address 216.150.1.1, hosted on Amazon.com, Inc. infrastructure (AS16509) located in the United States. The SSL certificate was issued by Let's Encrypt (R13), a common certificate authority often exploited by malicious actors due to its accessibility. The domain appeared on two security blocklists, specifically PhishDestroy and PhishingDB, and its page title mimicked the official Ledger Live download page, increasing the likelihood of successful deception. Given the domain's current offline status, immediate risk of active exploitation is reduced. However, the infrastructure and tactics observed suggest a persistent threat. Organizations and individuals are advised to block the domain and its associated IP address (216.150.1.1) at the network level. Users who may have interacted with this domain should verify the integrity of their Ledger Live installations and monitor for unauthorized transactions. Cryptocurrency wallet users are reminded to download software exclusively from official sources and verify SSL certificates to mitigate the risk of brand impersonation attacks.