ledgeraustralia[.]live

This domain, ledgeraustralia.live, is flagged as a brand impersonation threat specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to mimic Ledger’s official status or support pages, as evidenced by the page title 'Ledger Status.' No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with tactics used to deceive users into divulging recovery phrases or credentials under false pretenses of account verification or security updates.

Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 45.150.192.152, hosted on AS400992 (ZhouyiSat Communications) in the United States. The domain is currently flagged by 21 out of 95 security vendors on VirusTotal and appears on one security blocklist. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for both legitimate and malicious infrastructure. No Google Safe Browsing (GSB) detections were noted at the time of analysis, though this may reflect detection latency rather than absence of risk.

As of the latest assessment, ledgeraustralia.live has been taken offline, reducing immediate exposure. However, residual risk persists due to the domain’s recent registration and the potential for re-deployment under a new IP or subdomain. Users who interacted with the site prior to takedown should assume compromise of any submitted credentials or recovery phrases. Recommended actions include revoking access to any associated wallet addresses, monitoring for unauthorized transactions, and verifying future communications exclusively through Ledger’s official channels. The infrastructure’s use of a low-cost registrar and bulletproof hosting provider suggests a pattern consistent with financially motivated threat actors, warranting continued vigilance for similar impersonation attempts.