coinsledger[.]org

This domain, coinsledger.org, is confirmed as a brand impersonation phishing site targeting Ledger, a well-known hardware wallet provider. The site mimics legitimate Ledger services, presenting itself as a platform for software and cold wallets under the deceptive title 'Software Wallet & Cold Wallet | Hardware Wallet - Coins Ledger.' Analysis indicates this is a high-risk threat designed to deceive users into divulging sensitive cryptocurrency wallet credentials or downloading malicious software. The domain is currently offline, but its prior activity and infrastructure warrant close scrutiny. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc., a common registrar for both legitimate and malicious domains. It resolves to the IP address 172.67.169.216, which is associated with Cloudflare services, a frequent choice for threat actors seeking to obfuscate their hosting origins. The domain has been flagged by 17 of 95 security vendors on VirusTotal, indicating broad consensus among cybersecurity tools regarding its malicious nature. Additionally, it appears on four security blocklists, including Codeesura, Polkadot, PhishDestroy, and Enkrypt. The Gridinsoft trust score for this domain is 0/100, further corroborating its classification as a high-risk entity. Technologies detected on the site include Smartsupp, Cloudflare Browser Insights, and HTTP/3, which are not inherently malicious but are often leveraged to enhance the appearance of legitimacy. As of the latest assessment, coinsledger.org is offline, though this status may change. Organizations and individuals are advised to treat this domain as malicious and maintain its inclusion in blocklists. Users who may have interacted with the site should immediately revoke any associated wallet permissions, monitor for unauthorized transactions, and consider resetting credentials for any accounts linked to the domain. Network administrators should ensure DNS filtering rules block resolution of this domain and its associated IP address. Given the persistent nature of such threats, continuous monitoring for similar impersonation domains targeting cryptocurrency services is recommended. If re-activated, the domain should be re-evaluated for updated indicators of compromise.