ledger-com[.]com

PhishDestroy identifies ledger-com.com as an active crypto drainer impersonating the Ledger wallet brand. This domain mimics the official Ledger Chinese-language interface to deceive users into downloading malicious wallet software or entering seed phrases. The threat is categorized as a 'crypto drainer' due to its intent to steal cryptocurrency assets by tricking users into interacting with a fake wallet interface or malware distribution system.

This domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating moderate detection but persistent malicious activity. It was registered through Dynadot Inc on December 10, 2025, making it a very recently established threat actor resource. The domain resolves to IP address 156.250.67.230 and uses a valid SSL certificate issued by Let's Encrypt, which may help it evade browser-based warnings. While the domain does not yet appear on Google Safe Browsing (GSB) blocklists, it has been reported widely enough to be included in multiple threat intelligence feeds. The age of the domain (just over one month) and its high-risk classification suggest it is part of a coordinated phishing campaign targeting Ledger users.

As of the latest scan, ledger-com.com remains active and fully operational, serving a fraudulent Ledger wallet page in Chinese. This domain is part of an ongoing campaign, and its continued availability suggests the threat actors are actively evolving their infrastructure. Users are strongly advised to avoid visiting this domain. If you suspect exposure, disconnect devices from the internet, revoke permissions for any connected crypto apps, and use PhishDestroy’s verification tool to confirm the legitimacy of Ledger-related websites. Due to the presence of a crypto drainer and the active nature of the domain, the risk level remains high. Users should treat all non-official Ledger domains with extreme caution and only use verified sources such as the official ledger.com domain.