ledgerwalletmanager[.]web[.]app

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Ledger, a hardware wallet provider. Analysis indicates the infrastructure was designed to deceive users into interacting with fraudulent wallet management interfaces, likely facilitating unauthorized crypto asset transfers or credential harvesting. The threat type aligns with known crypto drainer tactics observed in similar campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 199.36.158.100 and is registered through Google LLC, utilizing an SSL certificate issued by Google Trust Services (WR4). Security vendors on VirusTotal flagged the domain at a 13/95 detection rate, while it appears on two independent security blocklists. The page title, 'Site Not Found,' suggests either a takedown response or an attempt to evade detection post-compromise. No creation date was provided, but the use of a .web.app subdomain indicates potential abuse of free hosting services. Mitigation steps for users and organizations include immediate blocking of the domain and IP at firewall and DNS levels. Ledger users should verify all wallet management interfaces through official channels only, avoiding third-party links. Security teams are advised to monitor for additional subdomains under .web.app or similar hosting platforms that may emerge as part of this campaign. If interaction with the domain occurred, users should revoke all connected wallet sessions and audit transaction histories for unauthorized activity. The offline status does not eliminate risk, as threat actors may redeploy infrastructure under new domains.