# Phishing sites impersonating Ledger

PhishDestroy has recorded 8,827 phishing domains impersonating Ledger since 2025-07-09, 135 of them in the last 30 days. The most used registrars are Cloudflare and Wix Studio; the most common TLDs are .dev and .com. The official Ledger domain is ledger.com: any other site asking for your login or wallet is not Ledger.

8,827Domains, all time

135Last 30 days

3,791Online at last check

2,000Confirmed takedowns

## New domains in the last 90 days

Ledger phishing domains detected per day: 1,138 from 2026-07-25 to 2026-10-22; peak 155.

## How to tell a fake Ledger site

Official domain: ledger.com.

Words most often added to the brand in reported domains: desktop, ledgr, start, eng, wallet, login, home, learn, download, ledgerlive.
- Type the address yourself or use a bookmark; phishing links for Ledger arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- Ledger will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest Ledger phishing domains

The 50 most recently detected domains impersonating Ledger
Domain | First detected | Status at last check | Registrar | 
[fkmvault.info](https://phishdestroy.io/domain/fkmvault.info/) | 2026-10-22 | Online | NICENIC | 
[ledger-msqco99.app.builtwithrocket.new](https://phishdestroy.io/domain/ledger-msqco99.app.builtwithrocket.new/) | 2026-10-21 | Online | Namecheap | 
[strkveil.online](https://phishdestroy.io/domain/strkveil.online/) | 2026-10-21 | Online | Porkbun | 
[strkshield.xyz](https://phishdestroy.io/domain/strkshield.xyz/) | 2026-10-21 | Online | Porkbun | 
[solcard.my](https://phishdestroy.io/domain/solcard.my/) | 2026-10-21 | Online | Spaceship | 
[alzafondavikk.shop](https://phishdestroy.io/domain/alzafondavikk.shop/) | 2026-10-21 | Online | NETIM | 
[bearchamp.com](https://phishdestroy.io/domain/bearchamp.com/) | 2026-10-20 | Offline | NICENIC | 
[mint-ledger.com](https://phishdestroy.io/domain/mint-ledger.com/) | 2026-10-20 | Offline | Cloudflare | 
[open-ledger.dev](https://phishdestroy.io/domain/open-ledger.dev/) | 2026-10-20 | Online | CloudFlare | 
[cafexvault.info](https://phishdestroy.io/domain/cafexvault.info/) | 2026-10-20 | Online | NICENIC | 
[veililt.xyz](https://phishdestroy.io/domain/veililt.xyz/) | 2026-10-20 | Online | NICENIC | 
[afriquantai.pro](https://phishdestroy.io/domain/afriquantai.pro/) | 2026-10-20 | Online | Dynadot | 
[fuzzyvault.info](https://phishdestroy.io/domain/fuzzyvault.info/) | 2026-10-20 | Online | NICENIC | 
[lofi-ledger.com](https://phishdestroy.io/domain/lofi-ledger.com/) | 2026-10-20 | Online | Cloudflare | 
[xspectarvault.info](https://phishdestroy.io/domain/xspectarvault.info/) | 2026-10-20 | Online | NICENIC | 
[fuzionxio.com](https://phishdestroy.io/domain/fuzionxio.com/) | 2026-10-20 | Online | NICENIC | 
[getsurecard.vip](https://phishdestroy.io/domain/getsurecard.vip/) | 2026-10-20 | Online | NICENIC | 
[serv-ledger.com](https://phishdestroy.io/domain/serv-ledger.com/) | 2026-10-20 | Online | Key-Systems | 
[espace-ledger.com](https://phishdestroy.io/domain/espace-ledger.com/) | 2026-10-20 | Offline | NameSilo | 
[rsp-ledger.com](https://phishdestroy.io/domain/rsp-ledger.com/) | 2026-10-20 | Online | Name.com | 
[ledgerupdate.org](https://phishdestroy.io/domain/ledgerupdate.org/) | 2026-10-20 | Offline | Unstoppable Domains | 
[dow-nload-ledger-live--doc.typedream.app](https://phishdestroy.io/domain/dow-nload-ledger-live--doc.typedream.app/) | 2026-10-20 | Online | — | 
[lexledger-capital.com](https://phishdestroy.io/domain/lexledger-capital.com/) | 2026-10-20 | Online | Cosmotown | 
[advisionsmarketing.com](https://phishdestroy.io/domain/advisionsmarketing.com/) | 2026-10-20 | Online | Spaceship | 
[adrivesthr.digital](https://phishdestroy.io/domain/adrivesthr.digital/) | 2026-10-20 | Online | NETIM | 
[anniversary-xaman.app](https://phishdestroy.io/domain/anniversary-xaman.app/) | 2026-10-19 | Online | Dynadot | 
[ledger-live-download-auth-co.typedream.app](https://phishdestroy.io/domain/ledger-live-download-auth-co.typedream.app/) | 2026-10-19 | Online | — | 
[airdrop.whitelist-ripple.com](https://phishdestroy.io/domain/airdrop.whitelist-ripple.com/) | 2026-10-19 | Online | DYNADOT | 
[xrp-ecosystem.org](https://phishdestroy.io/domain/xrp-ecosystem.org/) | 2026-10-19 | Online | NameSilo | 
[csc-lht.com](https://phishdestroy.io/domain/csc-lht.com/) | 2026-10-19 | Online | NICENIC | 
[en-leger.org](https://phishdestroy.io/domain/en-leger.org/) | 2026-10-19 | Online | Key-Systems | 
[practice-ledger.com](https://phishdestroy.io/domain/practice-ledger.com/) | 2026-10-19 | Online | Name.com | 
[superbuyfr.pics](https://phishdestroy.io/domain/superbuyfr.pics/) | 2026-10-19 | Online | Spaceship | 
[xamhub.info](https://phishdestroy.io/domain/xamhub.info/) | 2026-10-19 | Online | NICENIC | 
[dfnvjdfnvdjnfvdjfvdndfjvn.com](https://phishdestroy.io/domain/dfnvjdfnvdjnfvdjfvdndfjvn.com/) | 2026-10-19 | Online | NICENIC | 
[xrplwallethub.org](https://phishdestroy.io/domain/xrplwallethub.org/) | 2026-10-19 | Offline | Eranet | 
[safe-ldgreliveapp.typedream.app](https://phishdestroy.io/domain/safe-ldgreliveapp.typedream.app/) | 2026-10-19 | Online | — | 
[support--legderlive--us--learn.typedream.app](https://phishdestroy.io/domain/support--legderlive--us--learn.typedream.app/) | 2026-10-19 | Online | Squarespace Domains II | 
[ledger-api-live.com](https://phishdestroy.io/domain/ledger-api-live.com/) | 2026-10-17 | Online | NICENIC | 
[ledger-com-start-sso-start-web.typedream.app](https://phishdestroy.io/domain/ledger-com-start-sso-start-web.typedream.app/) | 2026-10-17 | Offline | — | 
[ledger-live-donload-web.typedream.app](https://phishdestroy.io/domain/ledger-live-donload-web.typedream.app/) | 2026-10-17 | Offline | — | 
[ldg-support.top](https://phishdestroy.io/domain/ldg-support.top/) | 2026-10-17 | Offline | Registrar.eu | 
[ledger-web-live.typedream.app](https://phishdestroy.io/domain/ledger-web-live.typedream.app/) | 2026-10-16 | Offline | Squarespace Domains II | 
[republic-ledger.top](https://phishdestroy.io/domain/republic-ledger.top/) | 2026-10-16 | Online | PublicDomainRegistry.com | 
[btcmixer.guide](https://phishdestroy.io/domain/btcmixer.guide/) | 2026-10-16 | Online | Regery.com | 
[sl8.online](https://phishdestroy.io/domain/sl8.online/) | 2026-10-16 | Online | Gandi | 
[synchronisation-ledger.com](https://phishdestroy.io/domain/synchronisation-ledger.com/) | 2026-10-15 | Online | NameSilo | 
[qcs-ledger.com](https://phishdestroy.io/domain/qcs-ledger.com/) | 2026-10-15 | Online | PublicDomainRegistry.com | 
[ledger.net.cn](https://phishdestroy.io/domain/ledger.net.cn/) | 2026-10-15 | Online | 成都西维数码科技有限公司 | 
[xrpairdrop.net](https://phishdestroy.io/domain/xrpairdrop.net/) | 2026-10-15 | Unknown | NICENIC | 

[All 8,827 Ledger reports](https://phishdestroy.io/domain/?brand=Ledger)

## Where they are registered and hosted

### Registrars

- Cloudflare3,780
- Wix Studio1,376
- Cloudflare Pages570
- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)208
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)187
- [1API](https://phishdestroy.io/registrar/1api-gmbh/)148
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)124
- [Registrar.eu](https://phishdestroy.io/registrar/registrar-eu/)115

### Top-level domains

- [.dev](https://phishdestroy.io/tld/dev/)4,308
- [.com](https://phishdestroy.io/tld/com/)2,738
- [.app](https://phishdestroy.io/tld/app/)408
- [.io](https://phishdestroy.io/tld/io/)366
- [.org](https://phishdestroy.io/tld/org/)141
- [.live](https://phishdestroy.io/tld/live/)126
- [.net](https://phishdestroy.io/tld/net/)83
- [.xyz](https://phishdestroy.io/tld/xyz/)70

### Hosting networks

- Cloudflare, Inc.4,388
- Google LLC958
- CLOUDFLARENET, US842
- CLOUDFLARENET - Cloudflare, Inc., US446
- GOOGLE-CLOUD-PLATFORM - Google LLC, US325
- Amazon.com, Inc.228
- AMAZON-02, US165
- AS-NUXTCLOUD INTERNATIONAL HOSTING COMPANY LIMIT84

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/)
- [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Ledger; share of all PhishDestroy reports: 3.93%.

Canonical: https://phishdestroy.io/brand/ledger/