ledger-com-apps[.]co

Analysis of ledger-com-apps.co indicates a high-risk domain associated with crypto drainer activity, registered on July 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain remains active and is currently flagged by one security blocklist, specifically PhishDestroy. Infrastructure analysis reveals Cloudflare nameservers (collins.ns.cloudflare.com and joaquin.ns.cloudflare.com) and resolves to the IP address 104.21.4.89, a common hosting provider for both legitimate and malicious domains.

Despite being scanned by 91 vendors on VirusTotal, no detections were recorded at the time of analysis; however, the absence of detections does not confirm the domain's safety and may reflect delayed or incomplete vendor coverage for newly registered domains. The domain's registration date aligns with its first appearance in threat intelligence sources, suggesting it was likely set up for immediate malicious use. No additional details regarding the page title, specific brand impersonation, or scam kit are currently available, limiting further classification beyond its designation as a crypto drainer threat.

Defenders should treat this domain as suspicious based on its registration context, blocklist presence, and association with crypto-related fraud. Network-level blocking or monitoring of connections to 104.21.4.89 and related Cloudflare-hosted domains is recommended until further analysis confirms its status. Given the domain's recent creation and active status, continuous monitoring for new detections or blocklist additions is advised.