ledger-live-working[.]com

The domain ledger-live-working.com has been identified as a threat due to its involvement in brand impersonation activities targeting Ledger. The domain was likely used to deceive users into believing they were interacting with the legitimate Ledger platform, possibly to steal sensitive information or cryptocurrency. The domain name itself is crafted to closely reflect the legitimate brand, increasing the likelihood of successful deception.

Technical analysis reveals that the domain has a VirusTotal detection score of 15 out of 95, indicating that multiple security vendors have flagged it as malicious. It was registered through Hello Internet Corp and resolves to the IP address 172.67.192.196. The domain was created on March 28, 2026, and is currently listed on one security blocklist. The domain was also detected in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious intent.

As of the current assessment, the domain is offline, having been taken down following its identification and blocking by PhishDestroy. Despite its offline status, the risk remains elevated as phishing domains often reappear under different names or hosting. Users are advised to remain vigilant and verify the authenticity of URLs before entering any sensitive information. Organizations should ensure that their security solutions are up-to-date and capable of detecting impersonation attempts, while also educating users about the risks associated with phishing domains.