recoverysupportcentre-ledger[.]com

This domain, recoverysupportcentre-ledger.com, presents an elevated-risk brand impersonation threat targeting Ledger cryptocurrency wallet users. The site mimics the legitimate Ledger Live interface, displaying the page title 'Ledger Live' to deceive visitors into entering sensitive wallet credentials or recovery phrases. Such tactics are commonly associated with crypto drainer schemes, where attackers gain unauthorized access to victims' digital assets and transfer funds to attacker-controlled wallets without consent. The fraudulent nature of this site is further evidenced by its attempt to exploit trust in the Ledger brand, a frequent target for phishing campaigns due to its widespread use in cryptocurrency storage. Analysis indicates that recoverysupportcentre-ledger.com was registered on February 26, 2026, through the registrar OnlineNIC, Inc. The domain currently resolves to the IP address 43.228.157.60, hosted under AS205759 (Ghosty Networks LLC) in Germany. Security vendor detections on VirusTotal report 20 out of 95 flags for malicious activity, while the domain appears on one additional security blocklist. Notably, the site lacks an SSL certificate, a red flag for users accustomed to secure connections when accessing financial or cryptocurrency-related services. Infrastructure analysis reveals the domain was taken offline following detection, though similar threats may re-emerge under different domains. Users who visited recoverysupportcentre-ledger.com or entered credentials on the site should assume their information has been compromised. Immediately revoke any access granted to third-party applications linked to the Ledger wallet and transfer remaining assets to a new, secure wallet. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. If recovery phrases or private keys were exposed, consider the original wallet permanently compromised. Report the incident to relevant cryptocurrency platforms and security teams to aid in tracking the campaign. Future vigilance is critical, as phishing domains often rotate quickly; always verify URLs and SSL certificates before interacting with any cryptocurrency service.