ledger-download[.]io

On July 23, 2026, the domain ledger-download.io was observed hosting a crypto‑scam page that mimics Ledger’s official “Ledger Live App – Download & Setup Desktop & Mobile App” title. The domain resolves to the IPv4 address 198.18.1.221 and is served by nameservers a.dnspod.com, b.dnspod.com and c.dnspod.com, which are typical of the dnspod infrastructure. Registration data shows the domain was created on 06 Nov 2025 and is registered through Hosting Concepts B.V. d/b/a Registrar.eu. No TLS certificate was presented during the last known connection, indicating the site operated over plain HTTP.

VirusTotal analysis recorded 17 of 95 scanning engines flagging the domain as malicious, and four independent blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura) have listed it. The site is currently offline, and its IP address is no longer serving content, but the historical evidence confirms a targeted impersonation of Ledger’s brand to lure cryptocurrency users. Analysis indicates that the infrastructure was deliberately provisioned to appear legitimate, leveraging the Ledger brand in the page title and the “download & setup” phrasing to encourage victims to submit credentials or install malicious software. The lack of a valid SSL certificate, combined with the recent registration date, suggests a short‑lived campaign typical of opportunistic crypto scams.

While the domain is presently inactive, the IP address 198.18.1.221 may have been reused for other malicious activities; defenders should monitor traffic to this address and related dnspod nameservers for future abuse. Organizations using Ledger products should update web filtering rules to block ledger-download.io and any subdomains, and employ DNS‑based threat intelligence feeds that include the four blocklists cited. Continuous review of outbound connections to unknown hosts and verification of TLS certificates when accessing Ledger services are recommended to mitigate similar impersonation attempts.