ledgersus[.]com

The domain ledgersus.com is a phishing site engaged in brand impersonation targeting Ledger, a manufacturer of cryptocurrency hardware wallets. It specifically poses as the legitimate Ledger website to deceive users into entering sensitive information such as seed phrases, enabling attackers to steal cryptocurrency assets. No drainer kit was identified in this campaign. As of the latest verification, ledgersus.com has been taken offline.

Technical indicators confirm the malicious nature of ledgersus.com. The domain was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, and appears on 1 security blocklist (PhishDestroy). It was registered through HOSTINGER operations, UAB on July 07, 2025, and resolves to the IPv6 address 2a02:4780:27:1804:0:bb2:5f58:9, hosted on AS47583 (Hostinger International Limited, France). No SSL certificate was issued for the domain, and its nameservers are ns1.dns-parking.com and ns2.dns-parking.com. The observed page title mimicked Ledger's official branding: 'Hardware Wallet & Cold Wallet - Security for Crypto | Ledger'.

Users who may have interacted with ledgersus.com should immediately revoke any token approvals and transfer funds to a new, secure wallet to prevent unauthorized access. If seed phrases or private keys were entered, assume the wallet is compromised. Additionally, monitor accounts for unauthorized transactions and enable two-factor authentication where available. Report the phishing domain to Ledger's official security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.