ledger-live-wallet[.]org

PhishDestroy has identified ledger-live-wallet.org as a confirmed brand impersonation site specifically targeting users of the Ledger hardware wallet ecosystem. This domain is currently offline and was designed to trick victims into believing they were accessing legitimate Ledger Live wallet services. The threat type is brand impersonation, a common tactic used to harvest cryptocurrency credentials and seed phrases.

The domain was created on March 28, 2026, and registered through Internet Domain Service BS Corp. It resolves to IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services (WE1). Security analysis reveals that 2 out of 95 VirusTotal vendors flagged this domain as malicious, and it appears on at least 1 security blocklist. AlienVault OTX data confirms the domain was found in 1 threat intelligence pulse, indicating active monitoring by security researchers. The low VT detection rate suggests the site was recently active and not widely reported, but the combination of brand impersonation and rapid registration flags it as high risk.

Although ledger-live-wallet.org is now offline, users who may have visited the site or entered sensitive information should immediately transfer funds to a newly generated wallet and enable two-factor authentication on all accounts. PhishDestroy recommends always verifying URL authenticity by manually typing the official Ledger address (ledger.com) and never entering seed phrases on any website. For compromised credentials, hardware wallet resets and software updates are advised to prevent further loss.