ledger-waliet[.]net

The domain ledger-waliet.net is identified as a brand impersonation threat targeting users of the Across bridge protocol and Exodus cryptocurrency wallet. Analysis confirms the domain is currently offline, though it previously hosted content mimicking Exodus wallet services. The specific threat type is classified as brand_impersonation, with the intent to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 21, 2026, and resolved to the IP address 172.67.143.168, hosted on Cloudflare’s network (AS13335). Security assessments indicate the domain was flagged by 16 of 95 vendors on VirusTotal, and it appeared on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the fraudulent nature of the domain. The page title, 'Exodus: the world’s leading bitcoin and crypto wallet,' further corroborates the impersonation of legitimate cryptocurrency services. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and associated IP (172.67.143.168) at the network perimeter. Users who accessed the domain should revoke any active sessions, rotate credentials, and monitor accounts for unauthorized transactions. Proactive measures include verifying domain authenticity via official channels and deploying endpoint detection rules to identify similar impersonation attempts.