ledger-secure[.]app

This domain, ledger-secure.app, is actively impersonating Ledger, a cryptocurrency hardware wallet provider, as part of a high-risk scam operation targeting digital asset holders. Registered on February 21, 2026, through Web Commerce Communications Limited, the domain resolves to IP address 172.67.200.187, hosted on Cloudflare's infrastructure (AS13335) in the United States. The domain is currently active and employs Cloudflare nameservers (malcolm.ns.cloudflare.com and nucum.ns.cloudflare.com), alongside HTTP/3 and a Google Trust Services SSL certificate (WE1). Analysis indicates the domain has been flagged by at least one security blocklist, with a Gridinsoft trust score of 0/100, suggesting minimal or no legitimate traffic. Two of 95 security vendors on VirusTotal have detected malicious activity associated with this domain. The HTTP response status is 403 (Forbidden), and the page title displays 'Just a moment...', a common Cloudflare interstitial that may obscure the actual phishing content from automated scans. The domain's infrastructure and naming convention strongly suggest an intent to deceive users into believing they are interacting with Ledger's official services. While the exact phishing mechanism remains unconfirmed due to the 403 response, the scam type is classified as cryptocurrency-related, aligning with Ledger's brand context. Defenders should prioritize blocking this domain at the DNS or network level, monitoring for related subdomains or IP associations, and alerting users to potential credential theft or unauthorized transaction attempts. Further investigation into the domain's hosting history and any linked infrastructure is recommended to identify additional threat vectors.