ledger-wallet-app[.]net

This domain, ledger-wallet-app.net, is identified as a high-risk brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. The domain was actively used to mimic legitimate Ledger services, likely for credential theft or crypto asset compromise. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Analysis indicates the domain was created on March 28, 2026, and registered through Web Commerce Communications Limited dba WebNic.cc. It resolved to the IP address 104.21.73.193, a shared hosting environment commonly exploited for malicious campaigns. The domain appears on three security blocklists and is flagged by 14 of 95 VirusTotal security vendors. Additionally, it was included in one AlienVault OTX threat intelligence pulse, further corroborating its malicious classification. The infrastructure and registration patterns align with known phishing operations targeting cryptocurrency users. The domain is currently offline, reducing immediate risk, but historical exposure may persist. Organizations and individuals are advised to block the domain and associated IP at the network level. Users who interacted with the domain should revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Security teams should review logs for prior connections to 104.21.73.193 and ledger-wallet-app.net to assess potential compromise.