appcleoajcoe[.]com

This domain, appcleoajcoe.com, is actively impersonating Ledger, a cryptocurrency hardware wallet provider, as of July 12, 2026. Analysis indicates the domain was registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 172.67.188.9, hosted on Cloudflare infrastructure in Canada. The page title explicitly mimics Ledger’s branding, displaying 'Ledger Crypto Wallet - Security for DeFi & Web3,' a clear attempt to deceive users into believing the site is legitimate. Infrastructure analysis reveals the domain uses Cloudflare nameservers (cass.ns.cloudflare.com and maxim.ns.cloudflare.com) and a Let’s Encrypt SSL certificate (identifier E7), which are common among both legitimate and malicious sites. However, the Gridinsoft trust score of 0/100 and its presence on one security blocklist, including detection by PhishDestroy, strongly suggest malicious intent. VirusTotal reports that 2 out of 95 security vendors flag the domain, though this low detection rate may reflect limited visibility rather than safety. The domain appears in one AlienVault OTX threat intelligence pulse, further corroborating its association with phishing activity. The HTTP 303 status code indicates the site may redirect users to another malicious resource, though the exact payload remains unconfirmed. Defenders should treat this domain as high-risk, particularly given its active status and direct targeting of Ledger’s brand. Organizations are advised to block the domain at the DNS or proxy level and monitor for related indicators, such as the resolving IP 172.67.188.9, to prevent potential credential theft or financial fraud.