ledger-live-download-app[.]com

The domain ledger-live-download-app.com was registered on February 21, 2026 through Hello Internet Corp and is hosted on Cloudflare infrastructure (AS13335) with the IP address 172.67.131.136 located in the United States. The domain is served by the nameservers ns100.webnic.cc and ns101.webnic.cc and does not present an SSL certificate, indicating that any client connections would be unencrypted HTTP. The page title returned by the server is identical to the domain name, "ledger-live-download-app.com," and the brand target is explicitly identified as Ledger. Intelligence sources classify the activity as a crypto‑related brand impersonation, consistent with a Ledger‑focused scam.

Two of ninety‑three security vendors on VirusTotal flagged the domain, and it is listed on four public blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—as well as appearing on four additional security blocklists. AlienVault OTX references the domain in a single threat pulse, further corroborating malicious intent. The current operational status is offline, and the domain has been taken down, but the observed infrastructure and detection history suggest that the site was used to lure victims into providing cryptocurrency credentials or payments under the guise of Ledger services.

Defenders should continue to block the domain at perimeter firewalls, DNS sinks, and proxy layers, and monitor for any residual traffic to the associated Cloudflare IP address. Since the site lacked TLS, any future re‑hosting of the same domain would remain easily detectable via HTTP inspection. Analysts are advised to track the registrar Hello Internet Corp for potential repeat registrations and to review related blocklist entries for similar patterns targeting Ledger or other cryptocurrency hardware wallet brands.