started-ledger[.]live

The domain started-ledger.live has been identified as a brand impersonation threat specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to mimic the official Ledger Live application interface, likely to deceive users into disclosing sensitive wallet credentials or installing malicious software. As of the latest verification, the domain has been taken offline, though prior activity suggests it was operational for a limited period. Technical indicators confirm the domain was registered through Cloudflare, Inc., and resolved to the IP address 172.67.68.93, associated with AS13335 (Cloudflare, Inc.) in the United States. The domain was flagged by 17 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. Additionally, it appeared on one security blocklist and was actively blocked by PhishDestroy. No SSL certificate was present, further reducing the legitimacy of the site. The page title, 'Ledger Live – The Trusted App for Managing Your Ledger,' directly mirrors the branding of the legitimate Ledger Live application, reinforcing the impersonation tactic. Current status confirms the domain is offline, though the infrastructure and registration details remain a concern for potential re-emergence. Users who may have interacted with this domain are advised to immediately revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address. Given the elevated risk of crypto asset theft, affected users should conduct a full security audit of their devices and wallets. Continuous monitoring of similar domains registered through the same infrastructure is recommended to preempt further impersonation attempts.