official-ledger[.]app

This domain, official-ledger.app, presents a brand impersonation threat targeting Ledger hardware wallet users. The site mimics legitimate support resources by displaying the page title 'Ledger Nano Problems: Solutions for Screen, Battery & USB,' designed to deceive users into believing it offers official troubleshooting guidance. Analysis indicates the domain specifically exploits common hardware issues (screen malfunctions, battery failures, USB connectivity) to establish false credibility and likely harvest sensitive wallet recovery phrases or personal information under the pretense of technical assistance. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Despite zero detections in VirusTotal's 95-engine scan (0/95), it appears on two security blocklists (PhishDestroy and OISD) and was previously flagged in one AlienVault OTX threat intelligence pulse. The site resolves to IP address 188.114.96.3 and employs Cloudflare with HTTP/3, utilizing a Google Trust Services SSL certificate to create an appearance of legitimacy. Users who visited official-ledger.app should take immediate containment actions. First, disconnect the device from networks and cease all interaction with the domain. Second, monitor all Ledger-associated accounts and cryptocurrency wallets for unauthorized transactions, particularly focusing on wallet addresses generated after the visit. Third, rotate all credentials that may have been exposed, including recovery phrases, PIN codes, and associated email passwords. Finally, scan the device with updated security tools to detect potential malware introduced through the site. Given the domain's offline status, users should remain vigilant for similar impersonation attempts using comparable naming patterns or support-themed content.