ledgerrrlive[.]com

PhishDestroy identifies ledgerrrlive.com as a brand impersonation domain targeting Ledger users. The site mimics Ledger’s branding to deceive visitors into disclosing sensitive information or transferring cryptocurrency. While no specific drainer kit has been confirmed, the domain’s structure and content strongly suggest credential theft or crypto-draining tactics.

This domain was flagged with a VirusTotal detection score of 11/95, indicating no antivirus or security tool has yet flagged it as malicious. Registered through Hosting Concepts B.V. d/b/a Registrar.eu, it resolves to IP 138.124.240.194 and was created on February 05, 2026. It has appeared on 2 security blocklists and is blocked by MetaMask and SEAL. The site utilizes a Let’s Encrypt SSL certificate, which may lend false legitimacy to unsuspecting users.

Currently, ledgerrrlive.com remains active and under investigation with a status of ‘active’ and a risk level of ‘under_investigation.’ Immediate actions include blocking the domain at the network and endpoint levels, updating blocklists for MetaMask and SEAL users, and monitoring for additional malicious payloads. Remaining risk is high due to its recent creation, low detection rates, and active impersonation tactics. Users are advised to avoid interacting with the domain and report any encounters to security teams or platforms like PhishDestroy.