showledger[.]app

showledger.app is flagged as a high‑risk brand‑impersonation site targeting Ledger users. The page title returned from the host is "ShowLedger", and the site advertises a crypto‑related service consistent with the classified "Crypto Scam". Technical fingerprinting shows the site is hosted behind Cloudflare, serves HTTP/3, and presents a TLS certificate issued by Google Trust Services (WE1). The server resolves to 216.24.57.1, an address mapped to AS397273 (Render) located in the United States. DNS is managed by GoDaddy.com, LLC using the authoritative name servers ns43.domaincontrol.com and ns44.domaincontrol.com. The front‑end stack includes Google Sign‑in, Tailwind CSS, and Stripe, suggesting attempts to collect credentials and payment information. Reputation services assign a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist. VirusTotal reports a single positive detection out of 95 scanned vendors. The site returns HTTP 200 for the root request, indicating an active web service. Blocklists such as PhishDestroy have already listed the domain, but the site remains reachable. Uncertainty remains around the exact content of the landing page and whether additional malicious payloads are delivered beyond credential harvesting. Defenders should block network traffic to 216.24.57.1, add the domain and its name servers to URL filtering policies, and monitor for related credential‑theft attempts targeting Ledger accounts. Continuous re‑evaluation is advised as the threat actor may modify the site or shift infrastructure.