ledger-coinbase[.]com

PhishDestroy identifies ledger-coinbase.com as a high-risk brand impersonation phishing site specifically targeting Coinbase users. This domain was designed to deceive victims into believing they are interacting with a legitimate Coinbase-related service, likely to harvest login credentials or cryptocurrency wallet details. The threat level is high due to the sophisticated impersonation and the potential for financial loss.

Technical analysis reveals several critical indicators: the domain was registered on January 6, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious registrations. It resolves to IP address 188.114.96.3 and bears an SSL certificate from WE1, which may give a false sense of security. VirusTotal flags this domain with 15 out of 95 security vendors detecting malicious activity, and it appears on 3 security blocklists. Additionally, AlienVault OTX has recorded it in 1 threat intelligence pulse, indicating awareness within the security community. The page title 'Nur einen Moment…' suggests a German-language interface, potentially targeting users in that region.

To mitigate risks from such impersonation sites, users should always verify domain names carefully—Coinbase's official domain is coinbase.com, not ledger-coinbase.com. Avoid entering any personal or financial information on sites accessed via unsolicited links or emails. Enable two-factor authentication on all cryptocurrency accounts and use a password manager to detect lookalike domains. If you have already interacted with this site, immediately change your passwords and contact Coinbase support for further guidance.