ledger-live-logins[.]com

This domain, ledger-live-logins.com, is flagged as a cryptocurrency phishing portal specifically designed to impersonate Ledger, a hardware wallet provider. Analysis indicates the site likely functioned as a credential harvester, targeting users attempting to access their Ledger Live accounts. The infrastructure was engineered to mimic legitimate Ledger authentication flows, potentially deploying a drainer kit to siphon wallet credentials, recovery phrases, or private keys upon submission. Infrastructure analysis reveals the following technical indicators: the domain was registered through Hello Internet Corp on March 28, 2026, and resolved to the IP address 104.21.39.145. Security vendor detections on VirusTotal reached 16/95, with the domain appearing on one security blocklist. The site was also identified in a single AlienVault OTX threat intelligence pulse, further corroborating its malicious intent. No entries were found in Google Safe Browsing at the time of assessment, though this does not preclude prior or intermittent malicious classification. The domain has since been taken offline, reducing immediate exposure to end users. However, residual risk persists due to the potential for re-registration or migration of the phishing infrastructure to alternative domains. Users who may have interacted with the site are advised to revoke any connected wallet authorizations, rotate recovery phrases, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators of compromise, while remaining vigilant for similar impersonation attempts targeting cryptocurrency platforms.