ledgerwallet[.]live

This domain, ledgerwallet.live, is currently flagged as a high‑risk brand‑impersonation site targeting Ledger users. The assessment records the domain as active, with a creation date of 21 February 2026 and registration performed by CommuniGal Communication Ltd. The site presents a page title identical to the domain name, and it has been placed on a security blocklist by PhishDestroy, confirming active malicious use.

The hosting infrastructure resolves to IP 185.53.179.200, which is allocated to AS206834 Team Internet AG in Canada. DNS resolution is handled by ns15.abovedomains.com and ns16.abovedomains.com. The web server runs Nginx and serves a Let’s Encrypt R12 certificate, delivering an HTTP 302 redirect. These technical components are typical of fast‑deployment phishing kits that rely on inexpensive shared hosting.

Reputation services assign a Gridinsoft trust score of 0 out of 100, and VirusTotal reports that three out of ninety‑five scanning engines have flagged the domain as malicious. The site is categorized as a cryptocurrency scam and explicitly impersonates the Ledger brand, aligning with the known scam type. Its appearance on a single blocklist suggests limited but targeted distribution, while the high‑risk label reflects the potential financial impact on compromised Ledger users.

Defenders should immediately block outbound and inbound traffic to 185.53.179.200 and add ledgerwallet.live to URL filtering and email security policies. Monitoring for DNS queries to the associated nameservers and for HTTP 302 redirects from the domain can help identify compromised clients. Incident response teams should treat any credential or seed‑phrase submissions linked to this domain as compromised, and users should be advised to verify Ledger communications through official channels only.