xn--ledgr-9za[.]com

PhishDestroy assesses xn--ledgr-9za.com as an elevated-risk threat due to its impersonation of the Ledger cryptocurrency wallet brand. This domain was specifically crafted to deceive users into believing it is a legitimate Ledger Live support or app portal, aiming to steal login credentials, recovery phrases, or other sensitive information. The domain's title, 'Ledger Live Crypto Wallet App | Ledger,' closely mimics official branding, increasing the likelihood of successful phishing attacks.

Technical indicators paint a clear picture of malicious intent. VirusTotal flagged the domain with 12 out of 95 security vendors marking it as malicious. It was registered on October 6, 2025, through Dominet (HK) Limited, a registrar often associated with suspicious domains. The domain resolves to IP address 104.18.34.152, which is linked to Cloudflare, a common hosting service used by phishers to evade detection. It appears on two security blocklists and was noted in one AlienVault OTX threat intelligence pulse. The absence of an SSL certificate further undermines any claim of legitimacy. The domain is now offline, but its short active period underscores the need for vigilance.

Users who have interacted with this domain should immediately change their Ledger account passwords and enable two-factor authentication if not already active. If any recovery phrases or private keys were entered, consider those compromised and transfer funds to a new, secure wallet. Report the incident to Ledger's official support team. Moving forward, always verify URLs by manually typing the official Ledger address (ledger.com) rather than clicking links, and bookmark legitimate sites. PhishDestroy recommends using a hardware wallet and enabling phishing alerts on your crypto exchanges for added protection.