ledger-diagnostics[.]live

This domain, ledger-diagnostics.live, has been identified as a brand impersonation threat specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to mimic legitimate Ledger diagnostic or support pages, likely to deceive users into entering sensitive credentials or wallet recovery phrases. The infrastructure and page title metadata suggest a focused campaign to exploit trust in the Ledger brand, a common tactic in cryptocurrency-related credential theft operations. Technical indicators confirm the domain's malicious nature. The domain was registered on February 21, 2026, through Name.com, Inc., and resolves to the IP address 34.111.179.208, hosted on AS396982 (Google LLC) in the United States. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. Detection metrics reveal that 21 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. The domain was also blocked by PhishDestroy, further corroborating its classification as a phishing resource. As of the latest assessment, ledger-diagnostics.live has been taken offline, reducing immediate exposure to potential victims. However, the domain's registration remains active, posing a residual risk of reactivation or repurposing. Users who may have interacted with the site are advised to revoke any connected wallet authorizations, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts. The elevated risk level persists due to the domain's recent creation and the persistent threat of brand impersonation in the cryptocurrency sector.