ledgercom-start[.]floot[.]app

This domain, ledgercom-start.floot.app, is actively impersonating Ledger, a hardware cryptocurrency wallet provider, as of July 12, 2026. Infrastructure analysis reveals the domain was registered on June 30, 2025, through NameCheap, Inc., and currently resolves to IP address 13.35.58.55. The page title, 'Ledger.com/Start® | Official Ledger Wallet™ Download Page,' explicitly mimics Ledger’s official onboarding process, indicating a brand impersonation campaign targeting users seeking to download legitimate wallet software. The domain is flagged by at least two security blocklists, including PhishDestroy and BLP-Malware, and has been assigned a trust score of 0/100 by Gridinsoft. Ten of 95 security vendors on VirusTotal have detected this domain as malicious, though the specific payload or infection chain remains unconfirmed. No evidence currently links this domain to a known phishing kit or threat actor group. Defenders should treat this domain as high-risk infrastructure. Blocking at the DNS or network level is recommended, along with monitoring for user interactions, particularly in environments where cryptocurrency-related services are accessed. The exact content of the page has not been analyzed, so additional indicators—such as embedded scripts, redirect chains, or wallet addresses—are not yet documented. Further investigation into the hosting provider and associated domains is advised to identify potential campaign clusters.