secure-app-ledgorr[.]wasmer[.]app

On 1 August 2026 the domain secure-app-ledgorr.wasmer.app was identified as a high‑risk credential‑phishing infrastructure. DNS resolution points exclusively to the IPv4 address 62.210.172.151, which is hosted by Wasmer Inc. The domain’s authoritative name servers are alpha.ns.wasmernet.com and beta.ns.wasmernet.com, both belonging to the same registrar. Registration data lists Wasmer Inc. as the registrant, confirming that the domain is tied to the Wasmer hosting platform rather than a separate malicious registrar. Threat intelligence feeds have flagged the domain on two public blocklists, and it is currently listed by PhishDestroy and OpenPhish as a malicious site.

VirusTotal has analyzed the domain and 14 of 91 security vendors returned a positive detection, indicating a moderate consensus among scanners that the site hosts malicious content. The domain remains active, with no evidence of takedown or sink‑hole mitigation. The concentration of evidence suggests that the operator is leveraging a legitimate hosting provider to hide malicious activity, a tactic that can reduce the likelihood of rapid remediation.

Defenders should add the domain and its resolving IP address to outbound filtering rules, update DNS‑based blocklists, and monitor for any new sub‑domains that resolve to the same IP. Continuous re‑scanning of the host on VirusTotal or similar platforms is recommended to capture any evolution of payloads or additional detections. Network telemetry that shows connections to 62.210.172.151 should be investigated for credential‑stealing activity, and affected users should be prompted to change any credentials that may have been entered on the site.