security-ledger[.]live

This domain, security-ledger.live, operates as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the infrastructure is designed to deceive users into divulging wallet credentials or installing malicious software under the guise of legitimate Ledger services. The domain mimics official Ledger branding, potentially tricking victims into entering sensitive recovery phrases or private keys, which could lead to unauthorized access and asset drainage from connected wallets. Evidence supporting this assessment includes detection by 20 out of 95 security vendors on VirusTotal, indicating widespread recognition of malicious intent. The domain was registered on April 12, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It appears on two security blocklists and is flagged in one AlienVault OTX threat intelligence pulse. Infrastructure analysis reveals the use of WordPress, Contentful, MySQL, PHP, and Amazon Web Services, suggesting a structured phishing framework. The domain resolves to the IP address 104.21.67.107, which has been linked to other suspicious activities in recent threat reports. Users who have interacted with security-ledger.live should immediately cease all engagement and revoke any permissions granted to associated applications or browser extensions. It is critical to audit connected cryptocurrency wallets for unauthorized transactions and rotate recovery phrases or private keys if exposure is suspected. Monitoring for unusual activity on linked accounts is advised, and affected users should report the incident to relevant security teams or incident response platforms. Organizations should update blocklists to include this domain and its resolving IP to prevent further access attempts.