ledger-app[.]store

The domain ledger-app.store is a confirmed phishing site engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. This site was designed to deceive users into believing it was an official Ledger application or service, posing an elevated risk of cryptocurrency theft through fraudulent login or wallet interaction pages. No drainer kit was identified in this campaign. As of the latest verification, ledger-app.store has been taken offline and is no longer accessible.

Technical indicators confirm the malicious nature of ledger-app.store. The domain was flagged by 1 of 95 security vendors on VirusTotal, including Kaspersky, and appeared on 1 security blocklist (PhishDestroy). It was registered through NiceNIC International Group Co., Limited on February 26, 2026, and resolved to the IP address 172.67.139.236, hosted on Cloudflare's infrastructure (AS13335) in the US. No SSL certificate was issued for the domain, and the observed page title was 'ledger-app.store | 520: Web server is returning an unknown error'. Nameservers were alla.ns.cloudflare.com and rocco.ns.cloudflare.com.

Users who interacted with ledger-app.store should immediately revoke any token approvals granted to unknown or suspicious contracts and transfer their cryptocurrency holdings to a new, secure wallet. Monitor transaction histories for unauthorized activity and enable two-factor authentication (2FA) on all accounts. Report the phishing domain to Ledger’s official security team via their support channels and submit the URL to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.