ledger-live-user[.]com

Ledger-live-user.com is a confirmed brand impersonation domain specifically targeting the Ledger cryptocurrency hardware wallet brand. This domain was registered on March 28, 2026, through Hello Internet Corp, and is designed to deceive users into believing it is an official Ledger support or wallet interface. The site likely employs a crypto drainer or credential theft scheme to steal users' recovery phrases and funds.

Technical analysis reveals that ledger-live-user.com has a VirusTotal detection rate of 2 out of 95 security vendors flagging it as malicious, indicating some initial recognition but limited coverage. The domain resolves to IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services (WE1). It appears on 1 security blocklist and is listed in 1 AlienVault OTX threat intelligence pulse. Google Safe Browsing status is not specified, but the elevated risk level and brand impersonation classification make it a clear threat.

As of the latest check, the domain is offline, likely due to takedown actions by authorities or hosting providers following reports. Users who may have visited the site should immediately change their Ledger recovery phrase and enable two-factor authentication on all crypto accounts. PhishDestroy recommends that users always verify URLs against official sources before entering sensitive information, and to report any similar domains to security teams. While the immediate risk is mitigated by the domain being offline, the same threat actors may register new domains, so continued vigilance is advised.