cgr-bogota[.]com

The domain cgr-bogota.com has been identified as a brand impersonation threat targeting the cryptocurrency wallet provider Ledger. No specific crypto drainer kit was detected, but the domain impersonates the brand to deceive users and potentially steal sensitive information.

Infrastructure analysis reveals that cgr-bogota.com is flagged by 3 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. The domain is registered through Hello Internet Corp and resolves to the IP address 162.241.61.79. It was first seen on blocklists and has a Gridinsoft trust score of 0/100, appearing on 3 security blocklists. The SSL certificate is issued by Sectigo Limited, which does not inherently suggest malicious intent but can be used to gain user trust. The page title found is 'CGR DOÑA JUANA SA ESP', which is inconsistent with the Ledger brand, further indicating an impersonation attempt.

The domain is currently offline, which suggests that it has been taken down or is no longer active. Despite this, the infrastructure used in the phishing campaign remains a concern. Security measures such as blocking by MetaMask, PhishDestroy, and SEAL have been implemented to protect users. However, the domain's presence on multiple blocklists and the low Gridinsoft trust score indicate that it poses an elevated risk. Organizations and individuals are advised to continue monitoring for any resurgence of activity and to ensure that users are aware of the dangers of brand impersonation.