ledger-v3[.]live

The domain ledger-v3.live was identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. This domain specifically presented itself as an official source for Ledger Wallet and Live App downloads, constituting a direct attempt to deceive users into installing malicious software. As of the latest assessment, the domain has been taken offline, though prior activity suggests elevated risk due to its targeted nature. Analysis indicates the domain was registered on October 28, 2025, through Spaceship, Inc., a domain registrar. It resolved to the IP address 172.67.203.154, hosted under AS13335 (Cloudflare, Inc.) in the United States. Security vendors flagged the domain in 9 of 95 VirusTotal detections, signaling broad recognition of its malicious intent. The domain appeared on one security blocklist, and no SSL certificate was present, further reducing its legitimacy. The page title, 'Ledger Download Desktop - Official Ledger Wallet & Live App Resources,' explicitly mimicked Ledger’s branding to enhance credibility. While ledger-v3.live is currently offline, the infrastructure and intent suggest a persistent threat. Users who may have interacted with this domain should verify installed applications, monitor for unauthorized transactions, and review system logs for anomalies. Organizations are advised to block the domain and associated IP address at the network level. Cryptocurrency wallet users should exclusively download software from verified official sources to mitigate similar risks.