ledgerwallet[.]com[.]cn

PhishDestroy identifies ledgerwallet.com.cn as an active crypto drainer campaign engaged in brand impersonation of Ledger. This domain is currently live and poses an elevated risk to users interacting with it. The campaign leverages social engineering tactics to deceive visitors into connecting crypto wallets or entering seed phrases, resulting in direct fund theft.

This domain was flagged by 16 of 95 VirusTotal security vendors, indicating a strong consensus on its malicious nature. It was registered on April 01, 2025, through 邦宁数字技术股份有限公司 (an Asia-based registrar). The domain resolves to IP address 207.148.34.163 and uses a Let's Encrypt SSL certificate to appear legitimate. Despite having only 16 VirusTotal detections, its creation date and impersonation strategy raise the risk level. No trust scores or blocklists are publicly documented, but the combination of recent registration, impersonation of a well-known crypto brand, and multiple VirusTotal detections strongly suggest active malicious use.

Ledger users and cryptocurrency holders should treat ledgerwallet.com.cn as actively hostile. This domain is not affiliated with Ledger SAS. Users are advised to verify any domain claiming to represent Ledger using PhishDestroy’s blocklist before interacting. Never enter seed phrases, private keys, or wallet passwords on unfamiliar domains. Do not connect hardware wallets or software to untrusted URLs. Report this domain to security teams and blocklist services. Only use official Ledger websites (ledger.com or ledger-live.com) and verified app stores for software updates and services.