ledger-live-connect[.]net

On 23 July 2026 analysts observed that the domain ledger-live-connect.net was taken offline but retains a set of artifacts that indicate a brand‑impersonation campaign aimed at harvesting cryptocurrency wallet seeds. The domain was registered on 21 February 2026 through Web Commerce Communications Limited dba WebNic.cc, and it resolves to the IPv4 address 193.24.123.182, which is announced by AS200593 (PROSPERO OOO) and geolocated to Russia. The hosting infrastructure therefore resides within a Russian network, a pattern commonly seen in illicit crypto‑related operations. The site served an HTTPS endpoint whose certificate is identified as “R12”, suggesting a self‑signed or low‑trust certificate rather than a publicly trusted CA. The visible page title, “Ledger Live Free Download | Official App Features 2025”, explicitly references the Ledger Live brand, confirming the impersonation intent.

The campaign is classified as a wallet/seed phishing operation, targeting users who may download a counterfeit application to exfiltrate their recovery phrase. Reputation services reflect the malicious nature of the domain. Scamadviser assigns a trust score of 17 / 100, while Gridinsoft rates it 0 / 100. VirusTotal scans returned 16 detections out of 93 scanners, and the domain appears on a single external blocklist. PhishDestroy has already added the domain to its blocklist, and AlienVault’s Open Threat Exchange lists it in one threat‑intel pulse, providing additional community corroboration.

Despite the offline status, defenders should continue to monitor the associated IP address and ASN for any re‑use, as threat actors often recycle infrastructure. Blocking 193.24.123.182 at the network perimeter and adding ledger-live-connect.net to URL filtering policies will prevent accidental user exposure. Security teams should also update endpoint protection signatures with the observed VirusTotal detection patterns and consider sharing the indicator set with industry ISACs.