dcentweb3ledger[.]com

PhishDestroy analysts have identified an active brand-impersonation attack leveraging the domain dcentweb3ledger.com to impersonate the legitimate hardware wallet provider Ledger. This elevated-risk site masquerades as a crypto wallet service, aiming to trick users into entering seed phrases or downloading malicious wallet software that could drain funds from connected accounts. The operation takes advantage of Ledger’s reputation to bypass user vigilance and deliver a trojan wallet payload, making it a credible and urgent threat to cryptocurrency users.

This domain was flagged by PhishDestroy’s automated pipeline and confirmed through rigorous threat intelligence analysis. dcentweb3ledger.com was created on October 27, 2025, and resolves to IP address 147.93.101.18. The site uses a Let’s Encrypt SSL certificate to appear legitimate and was registered anonymously via NameSilo, LLC, a registrar known for accommodating privacy protections that can obscure malicious intent. VirusTotal analysis shows only 1 out of 95 participating security vendors currently detect this domain as malicious, highlighting its ability to evade automated detection and remain active. The low detection rate suggests this campaign is in its early stages but rapidly evolving.

Given the specific threat of trojan wallet distribution, users must avoid interacting with dcentweb3ledger.com entirely. This domain does not represent any official Ledger service. Users should bookmark only the official Ledger domain (ledger.com) and verify all wallet downloads directly from the company’s verified channels. Enable hardware wallet verification for transactions and never enter seed phrases on websites or untrusted devices. Report any encounter with this domain to Ledger’s official support and to PhishDestroy’s threat intake system to aid in rapid takedown. Monitor device activity for unauthorized transactions, especially if wallet software was recently installed from unverified sources.