ledgercellar[.]sbs

This domain, ledgercellar.sbs, is identified as a high-risk brand impersonation site targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site functions as a crypto wallet drainer, designed to deceive users into connecting their wallets to malicious smart contracts, resulting in unauthorized fund transfers. The page title, 'Ledger Cellar Trade,' mimics legitimate Ledger services, leveraging familiar branding elements to enhance credibility and exploit user trust in the targeted brand.

Technical indicators confirm the domain's malicious nature. The domain resolves to IP address 173.208.213.194 and was registered through Dynadot LLC on October 27, 2025. Detection engines on VirusTotal flag the domain as malicious, with 16 out of 95 security vendors marking it as phishing or fraudulent. Google Safe Browsing categorizes the domain under 'SOCIAL_ENGINEERING,' and it appears on two independent security blocklists. Frontend technologies include Bootstrap, Apache HTTP Server, jQuery, and JivoChat, which are commonly used in phishing infrastructures to create convincing replicas of legitimate sites.

As of the latest assessment, ledgercellar.sbs has been taken offline, likely in response to detection and reporting by security entities such as PhishDestroy and InversionDNS. Despite its current offline status, the domain remains a residual risk due to potential re-activation or migration to alternative infrastructure. Users who interacted with the domain are advised to revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and verify the authenticity of any cryptocurrency-related communications. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.