ledger[.]org[.]im

This domain, ledger.org.im, is confirmed to host a crypto drainer phishing campaign designed to compromise cryptocurrency wallet credentials and private keys. Analysis indicates the site mimics the legitimate Ledger hardware wallet interface, presenting itself as the official Chinese-language portal (Page title: 'Ledger官方网站 - 全球领先的硬件冷钱包｜加密资产安全存储解决方案'). The threat actor employs malicious JavaScript payloads to intercept and exfiltrate sensitive wallet data, including seed phrases and transaction signatures, enabling unauthorized fund transfers from victim accounts. Infrastructure analysis reveals the domain resolves to the IP address 94.154.43.8 and has been flagged by 17 out of 95 security vendors on VirusTotal, indicating a high-confidence malicious classification. The domain is registered through an offshore registrar, a common tactic to evade takedown requests and obscure ownership. Additional threat intelligence confirms its presence in one AlienVault OTX pulse, further corroborating its association with active crypto-theft operations. The domain remains operational as of this report, with no indications of suspension or mitigation. Users who have visited ledger.org.im or interacted with its content should immediately revoke any connected wallet sessions and transfer assets to a new, secure wallet. All devices used to access the site should undergo a full malware scan to detect potential secondary infections. Wallet software and browser extensions should be updated to the latest versions, and users are advised to monitor transaction histories for unauthorized activity. Due to the high-risk nature of crypto drainers, affected individuals should consider reporting the incident to relevant blockchain analytics platforms and law enforcement cybercrime units for further investigation.