leggerr-iive-desktop[.]to

This domain is under investigation for brand_impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The threat involves distributing counterfeit Ledger Live desktop applications, likely to harvest credentials or deploy malware. Analysis indicates the domain is designed to deceive users into downloading malicious software under the guise of legitimate Ledger software updates or installations. Infrastructure analysis reveals the domain leggerr-iive-desktop.to was registered on August 28, 2025, through NAMECHEAP INC. It resolves to IP address 172.67.188.205 and currently shows 0/95 detections on VirusTotal, suggesting it has not yet been widely flagged by security vendors. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. No blocklist entries or trust score degradations have been recorded as of this assessment. The page title, 'Ledger Live application | Desktop download for teams,' further reinforces the impersonation by mimicking official Ledger branding and terminology. Mitigation requires immediate action from network defenders and end-users. Organizations should block the domain leggerr-iive-desktop.to and its resolving IP 172.67.188.205 at the perimeter firewall or DNS level. End-users should be educated to verify the authenticity of Ledger Live downloads exclusively through the official Ledger website or verified app stores. Cryptocurrency wallet users are advised to enable multi-factor authentication and scrutinize download sources for discrepancies in domain names, SSL certificates, or unexpected redirects. Security teams should monitor for connections to the IP or domain in logs and investigate any endpoints that have interacted with this infrastructure.