ledger-live-desktop-app[.]org

This domain, ledger-live-desktop-app.org, was registered on June 12, 2026, through Edomains LLC and is actively impersonating Ledger, a well-known hardware wallet provider. Infrastructure analysis reveals the domain resolves to 208.91.199.152, hosted in the United States under an Apache HTTP Server. The site currently returns an HTTP 403 status, indicating access is restricted, though the domain remains operational and unresolved by the registrar. Nameservers ns1.bh-25.webhostbox.net and ns2.bh-25.webhostbox.net are associated with the hosting provider, which has been previously linked to malicious infrastructure in other campaigns. Security vendors have flagged the domain on multiple blocklists, with 16 out of 95 engines on VirusTotal detecting it as malicious. PhishDestroy and Enkrypt have already classified it as a threat, and it holds a trust score of 0/100 from Gridinsoft. The SSL certificate, issued by Let's Encrypt, is valid but does not mitigate the risk, as threat actors routinely use free certificates to lend superficial legitimacy to phishing sites. The domain name itself is designed to mimic Ledger’s official software, likely targeting users attempting to download or update the Ledger Live desktop application. While the exact payload or deception method remains unclear due to the 403 status, the domain’s structure and registration details align with known impersonation tactics. Defenders should treat this domain as high-risk infrastructure, particularly for users of Ledger hardware wallets. Network-level blocking is recommended, as well as monitoring for related domains or subdomains that may emerge under the same nameserver or IP range. Given the domain’s recent creation and active status, further malicious activity is likely, and defenders should assume it may be used in credential theft or malware distribution targeting cryptocurrency users.