284248-ledger[.]com

This domain, 284248-ledger.com, is flagged as an active brand impersonation threat targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis indicates the site is designed to deceive users into believing they are interacting with legitimate Ledger services, likely to harvest credentials, private keys, or facilitate unauthorized transactions. No specific drainer kit signatures have been identified, but the domain’s structure and naming convention strongly suggest intent to exploit trust in the Ledger brand.

Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through Web Commerce Communications Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which is hosted on Cloudflare’s network, a common tactic to obfuscate origin servers. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns it a trust score of 0/100. The domain appears on 2 security blocklists, and its SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the underlying threat. Google Safe Browsing (GSB) status is not explicitly provided, but the domain is blocked by MetaMask and SEAL, further confirming its malicious classification.

Current status indicates the domain remains active, though it returns a 'Page not found' error, which may suggest a placeholder or temporary takedown of the phishing page. Despite this, the domain’s infrastructure remains intact, posing a continued risk. Recommended response actions include immediate blacklisting of the domain and IP across security gateways, monitoring for renewed phishing activity, and alerting users to verify domain authenticity before interacting with Ledger-related services. The elevated risk level persists due to the domain’s recent registration, Cloudflare obfuscation, and prior detection by multiple security vendors.