ledgerbox[.]info

PhishDestroy identifies ledgerbox.info as an active crypto drainer page impersonating the Ledger brand. The domain is currently resolving to IP 147.135.76.157 and leverages a Let’s Encrypt SSL certificate to enhance authenticity. The page title observed on-scene is ‘Fundd,’ which is consistent with known crypto wallet drainer kits that prompt users to connect wallets and authorize malicious transactions. The threat actor behind ledgerbox.info is attempting to exploit trust in the Ledger brand to trick cryptocurrency holders into surrendering control of their digital assets.

This domain was flagged under seed 6df13b and shows the following technical indicators: VirusTotal detection ratio is 1/95, indicating no current AV coverage; the domain was registered via Dynadot Inc on September 21, 2025; the current IP address is 147.135.76.157; the SSL certificate is issued by Let’s Encrypt. As of this report, the domain remains unblocked by Google Safe Browsing and has not been listed on major threat intelligence blocklists. These characteristics suggest a recently launched campaign with low detection coverage and high potential for victim engagement.

ledgerbox.info remains active as of this assessment. Immediate blocking at the DNS and network level is recommended to prevent further victimization. Users are advised to verify all wallet connection URLs against official Ledger domains and to avoid entering seed phrases or private keys on any page not served from ledger.com or ledger-live.com. The low AV detection rate and fresh registration date indicate elevated risk; continued monitoring and rapid takedown engagement are advised to reduce exposure.