myledgerwebextension[.]live

The domain myledgerwebextension.live is confirmed as a brand impersonation threat targeting Ledger, a manufacturer of cryptocurrency hardware wallets. Analysis indicates the site was designed to deceive users into connecting their hardware wallets under the pretense of a legitimate web extension, likely facilitating unauthorized access or asset drainage. The domain is currently offline, though prior activity suggests it was operational during a targeted campaign against cryptocurrency holders. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on October 30, 2025, and resolved to the IP address 162.254.39.102. Security vendor assessments show the domain was flagged by 10 of 95 VirusTotal engines, with detection on three independent blocklists. The Gridinsoft trust score for this domain is 0 out of 100, indicating a complete lack of legitimacy. The SSL certificate was issued by Sectigo Limited, a common certificate authority, though this does not mitigate the malicious intent of the domain. Additionally, the domain appeared in one threat intelligence pulse on AlienVault OTX, further corroborating its association with malicious activity. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and associated IP address (162.254.39.102) at the network level to prevent accidental access. Users who connected hardware wallets or entered sensitive information should assume compromise and take immediate steps to secure their assets, including revoking wallet permissions and monitoring for unauthorized transactions. Security teams should update detection rules to include this domain and its infrastructure in threat intelligence feeds to mitigate future risks from similar campaigns.