ledgar-com[.]app

Analysis of the domain ledgar-com.app indicates it is actively employed in a credential phishing scheme, specifically targeting individuals seeking to log into USAePay NMI services, as suggested by the page title 'USAePay NMI - Login'. The domain is registered with NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IP address 172.67.208.49, which is associated with Cloudflare, Inc., located in California. The domain is actively blocked by PhishDestroy and appears on one security blocklist, suggesting it is recognized as a threat by the security community. Furthermore, three out of ninety-one security vendors on VirusTotal have flagged this domain, indicating some level of malicious activity. The domain's SSL certificate is issued by Google Trust Services, reflecting a common tactic used by phishing sites to create a facade of legitimacy. Given its current status as active and the specific threat it poses, organizations should implement measures to block access to this domain and educate users about the risks of credential phishing, particularly those associated with financial services.