legder[.]in

This domain is flagged for elevated-risk brand impersonation targeting Ledger, a cryptocurrency and NFT wallet provider. The threat involves a fake wallet interface designed to harvest credentials or private keys from unsuspecting users under the guise of a legitimate service. Analysis indicates the domain was crafted to exploit trust in the Ledger brand, with technical indicators suggesting malicious intent. Infrastructure analysis reveals the domain legder.in was registered on September 21, 2025, through Web Commerce Communications Limited. It resolves to the IP address 104.21.66.95, hosted on Cloudflare infrastructure (AS13335) in the United States. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user data. Security vendors on VirusTotal flagged the domain with 10/95 detections, while it appears on one security blocklist and is blocked by PhishDestroy. The page title, 'Ledger - The Most Secure Cryptocurrency & NFT Wallet,' directly mimics the legitimate Ledger brand, further confirming the impersonation attempt. Mitigation steps for this threat type include immediate blocking of the domain and IP address across network security controls. Organizations should monitor for connections to 104.21.66.95 and alert users attempting to access legder.in. End-users should verify domain authenticity by cross-referencing official Ledger communications and ensuring SSL certificates are valid before entering sensitive information. Cryptocurrency wallet users are advised to enable multi-factor authentication and use hardware-based verification methods to mitigate credential theft risks. Security teams should update detection rules to include this domain and its associated indicators of compromise.