setup-ledger[.]live

On July 23, 2026, the domain setup-ledger.live was observed to be hosted offline. The domain was registered on February 21, 2026 and its sole page title reads “setup-ledger.live”. Intelligence sources associate the site with a crypto‑scam that attempts to impersonate the Ledger brand. AlienVault OTX has included the domain in 13 separate threat‑intel pulses, indicating repeated sightings across disparate feeds. VirusTotal analysis returned detections from 16 of 93 scanning engines, confirming that a substantial subset of commercial security products consider the domain malicious.

The domain is currently listed on two public blocklists, and both PhishDestroy and CryptoFirewall have taken active blocking actions against it. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of negligible reputation. No additional technical artifacts such as IP address, autonomous system number, hosting provider, or TLS certificate details were supplied, leaving those infrastructure components unverified at this time. The evidence points to a targeted brand‑impersonation campaign aimed at Ledger users, likely to lure victims into disclosing cryptocurrency wallet credentials or to initiate fraudulent transactions.

Because the site is already offline, real‑time mitigation is limited, but the presence on multiple blocklists suggests that continued monitoring of the domain’s DNS resolution and any potential re‑hosting attempts is warranted. Defensive operators should ensure that existing web‑filtering solutions incorporate the listed blocklists, update endpoint AV signatures to reflect the 16 VirusTotal detections, and consider adding the domain to internal deny lists. Analysts should also watch for new domains that share similar naming patterns or that appear in future OTX pulses, as the threat actor may employ a fast‑flux style registration cadence.