ledger-live-tokens[.]com

The domain ledger-live-tokens.com has been identified as engaging in brand impersonation, specifically targeting Ledger. This domain was created on March 28, 2026, and was designed to deceive users by mimicking the branding and appearance of Ledger, a well-known cryptocurrency wallet provider. The aim was likely to trick users into entering their credentials or private keys, thus compromising their cryptocurrency assets. The domain did not use any known drainer kits but relied on brand mimicry for its phishing attempts.

Technical indicators for ledger-live-tokens.com include a VirusTotal detection score where 14 out of 95 security vendors flagged the domain as malicious. The domain was registered through Hello Internet Corp, which is a common registrar for such phishing activities. The IP address it resolved to was 188.114.96.3. Currently, the domain is listed on one security blocklist, indicating recognition within threat intelligence communities. The domain's registration and subsequent detection suggest that it was likely part of a broader phishing campaign targeting Ledger users.

As of now, ledger-live-tokens.com has been taken offline, reducing the immediate threat posed by this domain. However, the fact that it was only found in one threat intelligence pulse on AlienVault OTX highlights the need for continued vigilance and monitoring of similar domains. Users are advised to rely on official sources for downloading cryptocurrency applications and entering sensitive information. Organizations should update their blocklists and educate users about the risks associated with phishing domains that impersonate trusted brands.