ledger-wallet[.]fr

Analysis of ledger-wallet.fr indicates a high‑risk brand‑impersonation campaign targeting Ledger users. The site presents a page titled “Ledger Crypto Wallet – Security for DeFi & Web3,” which mimics the legitimate brand’s messaging and is designed to lure cryptocurrency holders into disclosing private keys or seed phrases. The domain was registered on March 28 2026 through Gandi and resolves to IP 217.70.184.55, an address hosted in France and associated with Gandi’s French L/B services. DNS is served by Gandi’s authoritative name servers ns‑118‑a.gandi.net, ns‑139‑b.gandi.net, and ns‑57‑c.gandi.net. SSL is provided by GandiCert, and the site returns an HTTP 301 redirect, a pattern often used to forward victims to a credential‑harvesting form. Threat intelligence corroborates the impersonation claim: PhishDestroy has already blocked the domain, VirusTotal reports three of ninety‑five scanners flagging malicious behavior, and the site appears on one security blocklist. AlienVault OTX lists the domain in a single pulse, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the suspicion of phishing activity. No additional payloads or malware hashes have been observed, so the primary risk remains credential theft via a counterfeit wallet interface. Defenders should add ledger‑wallet.fr to URL filtering and sinkhole lists, enforce DNS‑based blocking in enterprise environments, and monitor outbound connections to 217.70.184.55. Incident response teams should educate users about the fake “Ledger Crypto Wallet” page and advise against entering seed phrases on any unverified domain. Continuous threat‑intel feeds should be queried for new indicators, and any detected C2 traffic to the IP should be investigated for potential expansion beyond credential harvesting.