ledgerlive[.]info

Analysis indicates that ledgerlive.info was actively used to host a crypto‑related impersonation campaign targeting Ledger users. The domain was registered on 14 October 2025 through Hosting Concepts B.V. operating under the Registrar.eu brand and is served by the DNS providers a.dnspod.com and c.dnspod.com. The authoritative name servers resolve the domain to the IP address 45.82.82.240, which belongs to AS9123 JSC TIMEWEB and is geolocated in Russia. No TLS certificate was observed, meaning the site was served over plain HTTP.

The page title returned by the server was “Ledger Live App – Download & Setup Desktop & Mobile App”, directly referencing the Ledger Live application and suggesting a download or setup flow. VirusTotal records show that 15 of 95 scanned security vendors flagged the domain as malicious, providing independent confirmation of its abusive nature. Additionally, the domain is listed on four public blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple threat‑intelligence feeds have already taken action against it. The current operational status is reported as offline, which may be due to takedown efforts or temporary hosting changes; however, the historical evidence remains relevant for detection and response.

Defenders should continue to block network traffic to 45.82.82.240 and to any future resolution of ledgerlive.info, enforce DNS‑based denial of the domain, and include the observed page title and registrar information in their threat‑intel feeds. Monitoring for re‑registration of the domain or for similarly crafted Ledger impersonation domains using the same registrar or hosting provider is advisable, as adversaries often recycle infrastructure. Because the site lacked TLS, any future reappearance would be trivially detectable via HTTPS enforcement policies. The combination of registrar, hosting, detection counts, and blocklist presence provides a high confidence indicator that ledgerlive.