ledger-apparaat[.]com

This domain, ledger-apparaat.com, was observed hosting a crypto‑wallet impersonation campaign targeting Ethereum users. The site’s HTML title reads “Ledger Crypto Wallet – Beveiliging”, indicating an attempt to masquerade as the Ledger hardware‑wallet brand. Registration data shows the domain was created on 2025-09-06 through Ultahost, Inc., and the associated SSL certificate is identified as WE1. Network resolution points to IP address 104.21.64.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a highly malicious assessment.

The domain appears on four independent security blocklists and has been flagged by multiple industry‑wide feeds: PhishDestroy, Polkadot, Enkrypt, and Codeesura list it as blocked, while AlienVault OTX references the domain in two separate threat‑intelligence pulses. VirusTotal analysis shows that 16 of 93 scanning engines flagged the domain as malicious, reinforcing the high‑risk classification. The campaign is categorized as a Crypto Scam, and the impersonated brand is Ethereum, consistent with the observed brand‑target field. Current operational status is offline, with the site taken down at the time of reporting.

Analysis indicates that the infrastructure—Cloudflare‑hosted IP and a low‑trust SSL certificate—facilitates rapid deployment and resilience against takedown, a pattern common to financially motivated crypto fraud. However, the exact phishing payload, credential‑stealing mechanisms, or any secondary C2 infrastructure have not been publicly disclosed, leaving those aspects uncertain. Defenders should immediately add ledger-apparaat.com to URL filtering and DNS blocklists, monitor for any resurgence of the domain or its IP range, and consider extending threat‑intel feeds to include the identified blocklists and OTX pulses.