start-legder[.]com

This domain is flagged as a high-risk fake cryptocurrency wallet impersonation targeting users of the legitimate Ledger hardware wallet platform. Analysis indicates the site is designed to deceive victims into entering recovery phrases or private keys, enabling unauthorized access to cryptocurrency holdings. The threat type, classified as a crypto drainer variant, leverages brand impersonation to exploit trust in established wallet providers. Infrastructure analysis reveals the domain start-legder.com was registered on May 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.96.3 and is currently active, hosting an open directory listing with the page title 'Index of /'. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (YE1), a common certificate authority used by both legitimate and malicious actors to enable HTTPS encryption. To mitigate risks associated with this fake cryptocurrency wallet impersonation, network administrators should immediately block the domain and its resolving IP address (188.114.96.3) at the firewall or DNS level. End users should be educated to verify domain authenticity by checking for subtle misspellings (e.g., 'legder' instead of 'ledger') and confirming SSL certificates through official channels. Cryptocurrency wallet users are advised to never enter recovery phrases or private keys on any website, regardless of apparent legitimacy. Organizations should monitor for outbound connections to the domain and IP, as these may indicate successful phishing attempts or ongoing compromise. Additional scrutiny should be applied to domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, particularly those created within the last six months.