ledgermobile[.]app

This domain is flagged for elevated risk due to brand impersonation targeting cryptocurrency users, specifically those associated with Ankr. The infrastructure presents itself as a legitimate hardware wallet service but functions as a fraudulent platform designed to deceive victims into exposing private keys or transferring assets to attacker-controlled addresses. Analysis indicates this is not a generic phishing attempt but a highly targeted scam leveraging the reputation of established crypto security brands. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain ledgermobile.app was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar frequently observed in fraudulent registrations. It resolves to the IPv6 address 2a02:4780:3f:2181:0:1550:bb98:2, hosted on AS47583 (Hostinger International Limited) in Germany. The domain currently lacks an SSL certificate, a red flag for user security. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist (PhishDestroy) and is currently offline, though this does not eliminate residual risk. The page title, 'Hardware Wallet & Crypto Wallet - Security for Crypto | Ledger,' directly impersonates Ledger’s official branding, further corroborating the brand impersonation threat. Mitigation for this specific threat type requires immediate action from both individual users and security teams. Cryptocurrency holders should verify all wallet-related domains by cross-referencing official sources, particularly when interacting with hardware wallet interfaces. Security teams should block the domain and associated IP at the network level, including IPv6 resolution paths. Given the absence of SSL, any connection to this domain would transmit data in plaintext, making credentials or seed phrases vulnerable to interception. Users who may have interacted with this domain should assume compromise, revoke any associated wallet permissions, and transfer assets to new, secure wallets. Monitoring for similar impersonation domains registered through Hostinger or Hosting Concepts B.V. is recommended, as threat actors often re-deploy infrastructure across multiple campaigns.