ledger-live-pros[.]com

This domain, ledger-live-pros.com, is flagged as a brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the infrastructure was designed to mimic legitimate Ledger Live software interfaces, likely to harvest user credentials, recovery phrases, or facilitate unauthorized transactions. No direct evidence of a drainer kit was observed, but the domain aligns with known phishing tactics used in crypto-theft campaigns. Infrastructure analysis reveals the domain was registered on March 28, 2026, through Hello Internet Corp, a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.2.243, a Cloudflare proxy endpoint commonly used to obscure hosting origins. The domain appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal, with detection names including phishing, fraud, and malicious site classifications. Additionally, it was identified in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious intent. As of the latest verification, ledger-live-pros.com has been taken offline, reducing immediate exposure risk. However, residual threats persist, including potential reuse of the domain or migration of the phishing infrastructure to alternative domains. Users who interacted with the site are advised to revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.