ledger-live-features[.]com

This domain, ledger-live-features.com, poses a direct threat to cryptocurrency users by impersonating Ledger’s official wallet management platform. Analysis indicates the site was designed to harvest sensitive credentials, including recovery phrases and private keys, which could lead to unauthorized access and theft of digital assets. The domain’s infrastructure and content closely mimic legitimate Ledger services, making it difficult for users to distinguish between the real and fraudulent site without technical scrutiny. Infrastructure analysis reveals the domain was registered on March 28, 2026, through Hello Internet Corp, a registrar frequently associated with malicious activity. It resolves to the IP address 172.67.153.30 and has been flagged by 2 out of 95 security vendors on VirusTotal, as well as appearing in one AlienVault OTX threat intelligence pulse. Additionally, the domain is listed on one security blocklist, further confirming its malicious intent. The creation date and registrar choice are consistent with patterns observed in phishing campaigns targeting financial and cryptocurrency platforms. Users who visited ledger-live-features.com should assume their credentials or recovery phrases may have been compromised. Immediate actions include revoking any active sessions linked to the domain, generating new wallet addresses, and transferring assets to a secure, unrelated wallet. It is also recommended to monitor transaction histories for unauthorized activity and enable multi-factor authentication on all related accounts. If sensitive information was entered, consider the affected wallet compromised and take steps to secure other linked accounts or devices.