craete-ledger-ssos[.]wasmer[.]app

PhishDestroy identifies the domain craete-ledger-ssos.wasmer.app as an active brand impersonation threat targeting Ledger users. The page mimics the official Ledger Start theme, suggesting the deployment of a drainer kit designed to trick victims into revealing sensitive wallet credentials. Evidence indicates this infrastructure is likely part of a coordinated social engineering campaign aimed at Ledger hardware wallet owners.

This domain resolves to IP 62.210.172.150 and operates under a Let’s Encrypt SSL certificate. VirusTotal currently scores the page at 4/95 detections, indicating it has not yet been widely flagged by antivirus engines. The domain was registered under a privacy-protected registrar and shows recent infrastructure activation. Google Safe Browsing has not yet classified the domain, and blocklist inclusion remains minimal. Technical analysis confirms the malicious page title (“Ledger Start | Fresh Theme Variant”) is an exact replica of legitimate Ledger branding, reinforcing its deceptive purpose.

The domain remains active and under investigation, with no immediate takedown confirmed. PhishDestroy advises users to avoid interacting with craete-ledger-sso.wasmer.app and to verify all URLs against Ledger’s official domains. Remaining risk is classified as moderate pending further takedown actions. Users are urged to report any suspicious activity involving this domain to PhishDestroy’s intelligence pipeline for rapid blocking.