web[.]ledger-live-app[.]io

This domain, web.ledger-live-app.io, is confirmed as a brand impersonation infrastructure targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site mimics the legitimate Ledger Live application interface, likely functioning as a crypto drainer or credential harvester to compromise user wallets and private keys. The domain exhibits characteristics consistent with phishing campaigns aimed at cryptocurrency holders, including the use of lookalike branding and urgent transaction prompts to manipulate victims. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 12, 2026, and resolves to IP address 104.21.3.237, hosted behind Cloudflare with HTTP/3 support. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. VirusTotal reports 11 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. No Google Safe Browsing (GSB) listing was detected at the time of analysis. The domain has been taken offline, reducing immediate risk to users. However, residual threats persist, including potential reuse of the domain or migration of the phishing kit to new infrastructure. Users who interacted with the site should assume credential compromise and take immediate action: revoke wallet access, transfer assets to new wallets, and monitor for unauthorized transactions. Organizations should update blocklists with the domain and IP address, while security teams should investigate related infrastructure for signs of broader campaign activity.