ledgere[.]com[.]cn

This domain, ledgere.com.cn, is flagged as a high-risk brand impersonation threat targeting Ledger, a manufacturer of cryptocurrency hardware wallets. Analysis of the page title, "Ledger官网｜全球领先的加密货币硬件冷钱包｜安全管理Defi和Web3资产," confirms the intent to deceive users into believing the site is the legitimate Ledger platform. No specific drainer kit signatures have been identified, but the domain closely replicates Ledger’s branding and service offerings, suggesting a likely credential harvesting or wallet-draining scheme. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 16, 2026, through 成都西维数码科技有限公司, a registrar based in China. It resolves to the IP address 52.128.228.85, hosted in Hong Kong by Simcentric Solutions Limited. The SSL certificate is issued by Let’s Encrypt (R13). VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Google Safe Browsing (GSB) status is not explicitly stated, but the presence on a blocklist and detections by multiple vendors indicate active malicious classification. As of the latest assessment, ledgere.com.cn remains active, posing a continued risk to users seeking Ledger’s official services. The domain’s infrastructure, including its hosting provider and SSL certificate, does not align with Ledger’s known legitimate domains (e.g., ledger.com). Users are advised to verify domain authenticity through official channels and avoid interacting with this site. Organizations should update blocklists to include this domain and monitor for related phishing campaigns targeting cryptocurrency users.