ledgerholm[.]com

PhishDestroy identifies ledgerholm.com as an active crypto drainer site designed to impersonate Ledger, a trusted hardware wallet provider. This domain deploys malicious JavaScript to siphon cryptocurrency from victims' wallets upon connection, a tactic increasingly used in phishing campaigns targeting crypto enthusiasts. While no specific drainer kit has been confirmed, the site's behavior aligns with known crypto-draining schemes, including wallet connection prompts and unauthorized transaction execution. This domain was registered through NETIM and currently resolves to the IP address 179.43.172.253. As of the latest scan, VirusTotal reports 10/95 detections, indicating no antivirus engines have flagged it yet. The SSL certificate is issued by Let's Encrypt (YR2), a common choice for both legitimate and malicious sites. Google Safe Browsing (GSB) has not listed the domain, and no blocklist entries have been recorded, suggesting it remains under the radar of most security tools. The domain's creation date and registrar details are still under investigation, but its active status and lack of detections raise concerns. Despite its low visibility in security databases, ledgerholm.com remains a significant threat due to its active crypto-draining capabilities. Users who interact with the site risk immediate and irreversible loss of funds. PhishDestroy recommends blocking the domain at the network level and reporting it to Ledger's security team for further action. Given the 10/95 VirusTotal score, users should exercise extreme caution, as traditional security tools may not yet recognize this threat. Always verify URLs before connecting wallets and use hardware wallets with caution to mitigate risks.