ledgerwallet[.]im

Analysis indicates that the domain ledgerwallet.im was registered on February 28, 2026, and is actively impersonating Ledger, a well-known cryptocurrency hardware wallet provider. Infrastructure analysis reveals the domain resolves to the IP address 45.207.200.62, hosted on AS8796 (FASTNET DATA INC) in the United States. The domain utilizes nameservers a7.share-dns.com and b7.share-dns.net, which have been associated with other suspicious infrastructure in prior investigations. As of July 24, 2026, the domain remains active and is flagged by five of ninety-three security vendors on VirusTotal, though the specific detection categories are not disclosed in available intelligence. The domain appears on one security blocklist and is blocked by PhishDestroy, further indicating its malicious classification as a crypto scam.

The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The page title, ledgerwallet.im, matches the domain name, which is a typical characteristic of brand impersonation but does not provide additional context about the exact content or functionality of the site. No evidence of Safe Browsing status, Open Threat Exchange (OTX) entries, or phishing kit identification is present in the available data. The registrar details are redacted, limiting attribution efforts.

Defenders are advised to treat this domain as high-risk infrastructure targeting Ledger users. Recommended actions include blocking the domain and its resolving IP at network and endpoint levels, monitoring for connections to the associated nameservers, and alerting users to potential crypto-related fraud attempts. Further investigation into the hosting provider and nameserver patterns may reveal additional linked infrastructure.