ledger-live-latest[.]com

This domain, ledger-live-latest.com, operates as a brand impersonation threat targeting users of Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to mimic the legitimate Ledger Live interface, likely to harvest login credentials, recovery phrases, or other sensitive authentication details. Such infrastructure is commonly used in crypto drainer schemes, where attackers gain unauthorized access to victims' wallets and transfer funds to attacker-controlled addresses. The domain's design and naming convention suggest an intent to deceive users searching for official Ledger software updates or support pages. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. The domain was registered on March 28, 2026, through Hello Internet Corp, a registrar frequently associated with phishing and fraudulent domains. At the time of assessment, VirusTotal reported 2 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was included in one AlienVault OTX threat intelligence pulse, further corroborating its association with phishing activity. Gridinsoft assigned a trust score of 0 out of 100, and the domain resolved to the IP address 188.114.97.3 before being taken offline. The page title, 'Server Not Found,' suggests recent deactivation, though historical activity remains a concern. Users who visited ledger-live-latest.com should take immediate action to mitigate potential risks. If any credentials, recovery phrases, or private keys were entered on the site, affected wallets should be considered compromised. Users are advised to transfer remaining funds to a new, secure wallet using a clean device and revoke any connected dApp authorizations. Monitor transaction histories for unauthorized activity and enable multi-factor authentication where available. Additionally, scan the device used to access the domain for malware, as phishing sites may deploy additional payloads. Given the domain's association with crypto credential theft, victims should report the incident to relevant blockchain security teams and law enforcement for further investigation.