ledgermobile[.]com

ledgermobile.com is a confirmed brand-impersonation phishing domain that masquerades as the official Ledger mobile crypto wallet in order to harvest users’ private keys and seed phrases. The landing page re-uses Ledger’s legitimate title, color scheme and wording to appear authentic, tricking visitors into entering recovery phrases that are sent directly to attacker-controlled wallets. Given the irreversible nature of cryptocurrency theft, this impersonation poses an immediate financial risk to any visitor who interacts with the page.

PhishDestroy identifies ledgermobile.com as an active brand-impersonation campaign with risk level under_investigation. Technical indicators include a VirusTotal score of 0 detections out of 95 engines (as of the last scan), registration via Name.com, Inc. on February 12 2026, and resolution to IP address 63.176.8.218. The domain currently holds a valid Let’s Encrypt SSL certificate and remains unblocked on all major threat intelligence feeds. The seed value 07e3b6 uniquely tags this sample for automated correlation by security researchers.

To mitigate exposure, users should immediately block 63.176.8.218 and the domain ledgermobile.com at the network and host levels. Never enter recovery phrases, private keys or passwords on any site not listed at ledger.com/apps; verify TLS certificate subject names manually. Report the domain to your organization’s SOC and to PhishDestroy using seed 07e3b6 for inclusion in future threat feeds. If you suspect interaction, revoke any exposed keys in a hardware wallet and transfer remaining assets to a newly generated address using a clean, air-gapped device.