ledger[.]recovery[.]5930217[.]com

The domain ledger.recovery.5930217.com has been identified as a brand impersonation threat targeting the cryptocurrency wallet provider Ledger. The site impersonates Ledger Live, a legitimate application used for managing Ledger hardware wallets, with the intent to deceive users and potentially steal credentials or perform other fraudulent activities. No specific drainer kit has been identified, but the domain is likely part of a broader phishing campaign designed to exploit the trust users have in the Ledger brand.

Analysis indicates that the domain has a VirusTotal score of 23/95, flagging it as potentially malicious. It was registered through CNOBIN INFORMATION TECHNOLOGY LIMITED and resolves to the IP address 178.16.54.253, which is located in the Netherlands and associated with AS202412 Omegatech LTD. The domain was created on December 06, 2025, and is currently listed on one security blocklist. The lack of an SSL certificate further suggests that the site is not a legitimate Ledger service. Despite these red flags, the domain is not listed in Google Safe Browsing (GSB), indicating a need for additional scrutiny.

The domain is currently offline, which reduces the immediate risk to users. However, the infrastructure could be reactivated at any time. Organizations and individuals are advised to monitor for any resurgence of activity and to ensure that all users are aware of the potential threat. Security teams should consider adding the domain to internal blocklists to prevent accidental access. Users who have visited the site or provided personal information are encouraged to change their passwords and monitor their accounts for any unauthorized activity.