ledgerone[.]co[.]uk

PhishDestroy identifies ledgerone.co.uk as an active crypto drainer domain impersonating Ledger, a hardware wallet provider. The domain is designed to deceive users into downloading malicious wallet drainer scripts under the guise of legitimate Ledger services. Technical analysis reveals this is a high-risk impersonation with significant potential for financial theft, particularly targeting cryptocurrency holders unfamiliar with Ledger’s official platforms. The domain leverages deceptive branding to exploit trust in established hardware wallet solutions. ledgerone.co.uk resolves to IP address 188.114.96.3 and was registered on May 22, 2020 through Squarespace Domains LLC. The domain currently shows 0 detections on VirusTotal (1/95 engines), indicating it remains largely undetected by security vendors at this time. Despite its low detection rate, it possesses an SSL certificate issued by Google Trust Services, enhancing its appearance of legitimacy. The domain is not currently blocklisted based on available threat intelligence feeds. The current status of this campaign is classified as active and under investigation, with an unknown drainer kit variant in circulation. Given the lack of blocklist entries and low antivirus detection, this threat poses a moderate to high risk to users visiting the domain or receiving related phishing communications. No active takedown actions have been confirmed as of this report. Users are strongly advised to avoid interacting with this domain and to cross-reference any unexpected Ledger-related communications with official sources. Remaining risk is elevated due to ongoing evasion tactics and low detection coverage among security solutions.