start-ledger-cdn[.]floot[.]app

Analysis of start-ledger-cdn.floot.app indicates an active brand impersonation campaign targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered June 30, 2025, through NameCheap, Inc., currently resolves to IP 198.18.1.93 hosted on Amazon.com, Inc. infrastructure (AS16509, DE). The page title 'Official Site® | Ledger.com/Start® | Getting Started' explicitly mimics Ledger's onboarding process, aligning with the reported crypto scam classification. Infrastructure review shows the domain uses AWS nameservers (ns-529.awsdns-02.net, ns-1658.awsdns-15.co.uk, ns-157.awsdns-19.com, ns-1527.awsdns) and lacks an SSL certificate, a deviation from Ledger's legitimate security practices.

The HTTP status returns 403 Forbidden, which may indicate server-side restrictions or defensive measures against automated scanning, though the domain remains flagged as active by monitoring systems. Detection coverage is limited but notable: one security vendor on VirusTotal flags the domain, and it appears on a single blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. No additional context about the phishing kit, payload delivery, or victim interaction is available at this time.

Defenders should prioritize blocking this domain at DNS and web gateway levels, particularly in environments handling cryptocurrency transactions. The absence of SSL and the use of a 403 status do not reduce risk; such configurations are occasionally used to evade detection while maintaining operational infrastructure. Further monitoring of the floot.app parent domain may reveal related malicious subdomains. Given the domain's recent registration and active status, continued vigilance is warranted.