ledgerhardware[.]live

This domain, ledgerhardware.live, was identified as a brand impersonation threat designed to deceive users of Ledger cryptocurrency hardware wallets. The site mimicked the official Ledger Live interface, presenting itself as the legitimate "Ledger Live Crypto Wallet App" with an identical page title. Such impersonation tactics are commonly used to harvest credentials, private keys, or install malicious software under the guise of trusted services.

Analysis indicates the domain was flagged by 21 out of 95 security vendors on VirusTotal, a significant detection rate for a newly registered domain. The domain was created on April 12, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolved to the IP address 172.67.168.176, hosted on infrastructure associated with Cloudflare, Inc. in Canada. The domain appeared on two security blocklists and was proactively blocked by multiple threat intelligence platforms. The SSL certificate was issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites.

Users who visited ledgerhardware.live should immediately revoke any sessions or authorizations granted through the site. All credentials or recovery phrases entered on the domain must be considered compromised and should be changed from a secure device. If cryptocurrency transactions were initiated from the site, users should transfer assets to a new wallet and monitor for unauthorized access. Devices used to access the domain should be scanned for malware, and browser sessions cleared to remove any residual tracking mechanisms.