ledgercraft[.]world

This domain, ledgercraft.world, is actively impersonating Ledger, a manufacturer of cryptocurrency hardware wallets, and has been classified as a high-risk phishing threat. Registered on April 14, 2026, through Dynadot Inc, the domain remains operational despite returning an HTTP 403 status, which may indicate an attempt to restrict access while maintaining malicious infrastructure. Infrastructure analysis reveals the domain is proxied behind Cloudflare, resolving to the IP address 188.114.96.3, located in Canada. The use of Cloudflare nameservers (noel.ns.cloudflare.com and serenity.ns.cloudflare.com) is consistent with threat actors leveraging content delivery networks to obscure origin servers and evade detection. Technical indicators support the phishing classification. The domain appears on one security blocklist and is flagged by three out of ninety-five security vendors on VirusTotal, suggesting moderate detection coverage. Additionally, it has been identified in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious intent. The SSL certificate, issued by Google Trust Services (WE1), provides a superficial layer of legitimacy but does not mitigate the underlying threat. The Gridinsoft trust score of 0/100 reinforces the domain's lack of credibility. While the current HTTP 403 status may limit immediate exposure, defenders should treat this domain as an active threat. The registration timeline and infrastructure choices align with known phishing campaign patterns targeting cryptocurrency users. Organizations are advised to block the domain at the DNS or network level and monitor for any changes in behavior, such as shifts in HTTP response codes or new subdomains. Given the domain's association with Ledger, security teams should also alert users to potential social engineering attempts, particularly those involving fake wallet updates or recovery phrases. No legitimate Ledger services are known to operate under this domain.