seeksledger[.]com

On July 25, 2026, investigators identified seeksledger.com as a confirmed wallet‑seed phishing infrastructure targeting Ledger users. The domain was created on February 21, 2026 and is currently taken offline, but historical records show it served a page titled “Ledger Live - Secure Digital Wallet | Download Ledger Live App,” a clear indicator of brand impersonation. The site was hosted on the IP address 104.21.64.11, which belongs to AS13335 Cloudflare, Inc., placing the server in the United States. Registration details reveal the domain was purchased through NameCheap, Inc., a common registrar for malicious actors due to its low‑cost, automated provisioning.

The SSL certificate presented the identifier WE1, offering encrypted transport but providing no assurance of legitimacy. Reputation services assigned a Gridinsoft trust score of 0 / 100 and a Scamadviser score of 41 / 100, reflecting extreme distrust. Security monitoring flagged the domain on a single blocklist and VirusTotal reported 10 of 93 scanning engines flagging it as malicious, reinforcing the phishing classification. PhishDestroy has already added the domain to its blocklist.

While the site is no longer reachable, the observed infrastructure—cloud‑based hosting, low‑trust registrar, weak SSL, and brand‑specific page title—remains indicative of a credential‑harvesting campaign. defenders should continue to block the domain and its associated IP, monitor for any re‑registration or similar patterns from the same registrar or hosting provider, and update detection rules to include the observed page title and SSL fingerprint. Ongoing vigilance is required to prevent future impersonation attempts that may reuse this template or infrastructure.