911trustledger[.]store

The domain 911trustledger.store is a cryptocurrency phishing site engaged in brand impersonation targeting Ledger, a well-known hardware wallet provider. It presents itself as a legitimate Ledger service under the deceptive name '911 Trust Ledger' but is designed to steal user credentials or funds through fraudulent interfaces. No drainer kit was identified, but the site operated as a scam page before being taken offline.

Technical indicators confirm the elevated risk. As of analysis, 1 of 95 VirusTotal security vendors flagged 911trustledger.store, including Gridinsoft, which assigned a trust score of 0/100. The domain was registered through Go Daddy, LLC on June 24, 2025, and resolved to the IP address 34.149.87.45, hosted on Google Cloud infrastructure (AS396982). It appeared on one security blocklist, PhishDestroy, while Google Safe Browsing did not flag it. The SSL certificate was issued by GoDaddy.com, Inc. under the 'Go Daddy Secure Certificate Authority - G2' chain. The observed page title was 'Home | 911 Trust Ledger', and technologies detected included Wix, React, Google Cloud CDN, and HSTS.

Users who interacted with 911trustledger.store should assume their credentials or wallet details may be compromised. If cryptocurrency transactions were attempted, revoke all token approvals and transfer funds to a new wallet immediately. Change passwords for any accounts accessed through the site and enable two-factor authentication where available. Report the domain to Ledger’s official security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.