Phishing sites impersonating Ledger

PhishDestroy has recorded 8,827 phishing domains impersonating Ledger since 2025-07-09, 135 of them in the last 30 days. The most used registrars are Cloudflare and Wix Studio; the most common TLDs are .dev and .com. The official Ledger domain is ledger.com: any other site asking for your login or wallet is not Ledger.

8,827
Domains, all time
135
Last 30 days
3,791
Online at last check
2,000
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 202026-07-26: 42026-07-27: 372026-07-28: 192026-07-29: 102026-07-30: 122026-07-31: 72026-08-01: 72026-08-02: 232026-08-03: 162026-08-04: 202026-08-05: 62026-08-06: 22026-08-07: 332026-08-08: 22026-08-09: 62026-08-10: 732026-08-11: 42026-08-12: 32026-08-13: 112026-08-14: 92026-08-15: 42026-08-16: 122026-08-17: 62026-08-18: 102026-08-19: 52026-08-20: 152026-08-21: 22026-08-22: 42026-08-23: 52026-08-24: 52026-08-25: 62026-08-26: 252026-08-27: 32026-08-28: 62026-08-29: 52026-08-30: 22026-08-31: 1552026-09-01: 492026-09-02: 12026-09-03: 32026-09-04: 82026-09-05: 52026-09-06: 72026-09-07: 272026-09-08: 982026-09-09: 22026-09-10: 582026-09-11: 282026-09-12: 112026-09-13: 92026-09-14: 292026-09-15: 552026-09-16: 32026-09-17: 102026-09-18: 02026-09-19: 32026-09-20: 32026-09-21: 02026-09-22: 42026-09-23: 12026-09-24: 02026-09-25: 12026-09-26: 02026-09-27: 12026-09-28: 22026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 12026-10-04: 42026-10-05: 02026-10-06: 72026-10-07: 92026-10-08: 32026-10-09: 122026-10-10: 62026-10-11: 32026-10-12: 02026-10-13: 162026-10-14: 62026-10-15: 132026-10-16: 42026-10-17: 42026-10-18: 02026-10-19: 132026-10-20: 192026-10-21: 52026-10-22: 1
Ledger phishing domains detected per day: 1,138 from 2026-07-25 to 2026-10-22; peak 155.

How to tell a fake Ledger site

Official domain: ledger.com.

Words most often added to the brand in reported domains: desktop, ledgr, start, eng, wallet, login, home, learn, download, ledgerlive.

  • Type the address yourself or use a bookmark; phishing links for Ledger arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Ledger will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Ledger phishing domains

The 50 most recently detected domains impersonating Ledger
DomainFirst detectedStatus at last checkRegistrar
fkmvault.info2026-10-22OnlineNICENIC
ledger-msqco99.app.builtwithrocket.new2026-10-21OnlineNamecheap
strkveil.online2026-10-21OnlinePorkbun
strkshield.xyz2026-10-21OnlinePorkbun
solcard.my2026-10-21OnlineSpaceship
alzafondavikk.shop2026-10-21OnlineNETIM
bearchamp.com2026-10-20OfflineNICENIC
mint-ledger.com2026-10-20OfflineCloudflare
open-ledger.dev2026-10-20OnlineCloudFlare
cafexvault.info2026-10-20OnlineNICENIC
veililt.xyz2026-10-20OnlineNICENIC
afriquantai.pro2026-10-20OnlineDynadot
fuzzyvault.info2026-10-20OnlineNICENIC
lofi-ledger.com2026-10-20OnlineCloudflare
xspectarvault.info2026-10-20OnlineNICENIC
fuzionxio.com2026-10-20OnlineNICENIC
getsurecard.vip2026-10-20OnlineNICENIC
serv-ledger.com2026-10-20OnlineKey-Systems
espace-ledger.com2026-10-20OfflineNameSilo
rsp-ledger.com2026-10-20OnlineName.com
ledgerupdate.org2026-10-20OfflineUnstoppable Domains
dow-nload-ledger-live--doc.typedream.app2026-10-20Online—
lexledger-capital.com2026-10-20OnlineCosmotown
advisionsmarketing.com2026-10-20OnlineSpaceship
adrivesthr.digital2026-10-20OnlineNETIM
anniversary-xaman.app2026-10-19OnlineDynadot
ledger-live-download-auth-co.typedream.app2026-10-19Online—
airdrop.whitelist-ripple.com2026-10-19OnlineDYNADOT
xrp-ecosystem.org2026-10-19OnlineNameSilo
csc-lht.com2026-10-19OnlineNICENIC
en-leger.org2026-10-19OnlineKey-Systems
practice-ledger.com2026-10-19OnlineName.com
superbuyfr.pics2026-10-19OnlineSpaceship
xamhub.info2026-10-19OnlineNICENIC
dfnvjdfnvdjnfvdjfvdndfjvn.com2026-10-19OnlineNICENIC
xrplwallethub.org2026-10-19OfflineEranet
safe-ldgreliveapp.typedream.app2026-10-19Online—
support--legderlive--us--learn.typedream.app2026-10-19OnlineSquarespace Domains II
ledger-api-live.com2026-10-17OnlineNICENIC
ledger-com-start-sso-start-web.typedream.app2026-10-17Offline—
ledger-live-donload-web.typedream.app2026-10-17Offline—
ldg-support.top2026-10-17OfflineRegistrar.eu
ledger-web-live.typedream.app2026-10-16OfflineSquarespace Domains II
republic-ledger.top2026-10-16OnlinePublicDomainRegistry.com
btcmixer.guide2026-10-16OnlineRegery.com
sl8.online2026-10-16OnlineGandi
synchronisation-ledger.com2026-10-15OnlineNameSilo
qcs-ledger.com2026-10-15OnlinePublicDomainRegistry.com
ledger.net.cn2026-10-15Online成都西维数码科技有限公司
xrpairdrop.net2026-10-15UnknownNICENIC

All 8,827 Ledger reports

Where they are registered and hosted

Registrars

  1. Cloudflare3,780
  2. Wix Studio1,376
  3. Cloudflare Pages570
  4. NiceNIC208
  5. NICENIC187
  6. 1API148
  7. NameSilo124
  8. Registrar.eu115

Top-level domains

  1. .dev4,308
  2. .com2,738
  3. .app408
  4. .io366
  5. .org141
  6. .live126
  7. .net83
  8. .xyz70

Hosting networks

  1. Cloudflare, Inc.4,388
  2. Google LLC958
  3. CLOUDFLARENET, US842
  4. CLOUDFLARENET - Cloudflare, Inc., US446
  5. GOOGLE-CLOUD-PLATFORM - Google LLC, US325
  6. Amazon.com, Inc.228
  7. AMAZON-02, US165
  8. AS-NUXTCLOUD INTERNATIONAL HOSTING COMPANY LIMIT84

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Ledger; share of all PhishDestroy reports: 3.93%.