ledger[.]qoomee[.]me

This domain, ledger.qoomee.me, is flagged for brand impersonation targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis indicates the site mimics legitimate Ledger services to deceive users into disclosing sensitive credentials or transferring assets. The page title, "清流司 | 个人多币种记账," suggests a localized approach, likely aimed at Chinese-speaking users, though no explicit crypto drainer kit signatures were detected in initial scans. The domain does not appear to host overt malware but relies on social engineering to exploit trust in the Ledger brand. Infrastructure analysis reveals several critical technical indicators. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 216.198.79.67. It is flagged by 3 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on two security blocklists and is blocked by PhishDestroy and OISD. It employs a Let's Encrypt SSL certificate and uses Vercel for hosting, alongside HSTS implementation, which may lend a false sense of legitimacy. No Google Safe Browsing (GSB) detections were reported at the time of analysis. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. While the immediate threat is mitigated, residual risks remain, particularly if the infrastructure is reactivated or repurposed. Organizations should monitor for related domains or IPs, as threat actors often re-deploy phishing campaigns using similar registrant details or hosting patterns. Users are advised to verify domain authenticity through official Ledger channels and avoid interacting with unsolicited communications or links. Security teams should update blocklists to include this domain and its associated indicators of compromise (IOCs) to prevent future exposure.