ledger-live-signin[.]com

This domain, ledger-live-signin.com, is confirmed to operate as a crypto credential theft site through brand impersonation of Ledger, a hardware wallet manufacturer. Analysis indicates the infrastructure was designed to harvest login credentials for Ledger Live accounts, enabling unauthorized access to cryptocurrency wallets and potential asset drainage. No direct evidence of a pre-packaged drainer kit was observed, but the domain structure and content closely mimic Ledger's official authentication portal, suggesting a targeted credential harvesting operation. Infrastructure analysis reveals the domain was registered through Hello Internet Corp on March 28, 2026, and resolved to IP address 172.67.176.109. Security telemetry shows the domain was flagged by 8 out of 95 security vendors on VirusTotal, with a single appearance in an AlienVault OTX threat intelligence pulse. The domain appears on one security blocklist and was actively blocked by at least one endpoint protection system. No detection by Google Safe Browsing was recorded at the time of analysis, indicating either recent takedown or evasion of broader detection mechanisms. The domain is currently offline, likely following enforcement action or voluntary suspension. While the immediate threat has been neutralized, residual risk remains for users who may have interacted with the site prior to takedown. Organizations should monitor for credential reuse attempts targeting Ledger accounts and consider proactive password resets for potentially exposed users. Network defenders are advised to update blocklists with the domain and associated IP address, while users should verify all Ledger-related communications through official channels only.