ledgercomstart[.]dream[.]space

PhishDestroy identifies ledgercomstart.dream.space as an active brand impersonation domain targeting Ledger. The domain was registered on November 08, 2024, through GoDaddy.com, LLC, and is hosted on IP 104.18.21.20. While VirusTotal currently shows 6/95 detections, this domain remains under investigation for its deceptive resemblance to Ledger's official channels. The domain leverages a Google Trust Services SSL certificate to appear legitimate, increasing the risk of user deception in phishing schemes. This domain exhibits multiple red flags: it was created on 2024-11-08, has an SSL certificate issued by Google Trust Services, and remains unresolved by major blocklists despite its suspicious nature. The exact phishing vector remains under analysis, but the mimicry of Ledger’s branding suggests an attempt to harvest credentials or cryptocurrency wallet details. The domain resolves to IP 104.18.21.20, a shared hosting environment frequently exploited for malicious activity. There are no confirmed associations with known drainer kits at this time, but the setup aligns with typical phishing infrastructure. Current status: Active and under investigation as a Ledger impersonation. No takedown has been executed yet, and VirusTotal continues to miss this domain despite its high-risk characteristics. Users should avoid interacting with ledgercomstart.dream.space and report it to Ledger’s official fraud channels. The remaining risk is classified as high due to the domain’s active status, SSL certificate, and minimal detection coverage. PhishDestroy recommends blocking the IP 104.18.21.20 and monitoring for further impersonation campaigns.