skyledger[.]web[.]app

Analysis of skyledger.web.app confirms its classification as an active phishing domain targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered on February 21, 2026, through Google LLC's Firebase platform, currently resolves to 199.36.158.100, an IP address geolocated to the United States under Google LLC's infrastructure. As of July 12, 2026, the domain returns an HTTP 200 status, indicating an operational web server. Infrastructure analysis reveals the use of Firebase hosting, with HTTP/3 and HSTS enabled, suggesting a modern web deployment. The SSL certificate is issued by Google Trust Services (WR4), consistent with Firebase-hosted domains. The domain appears on one security blocklist, and Gridinsoft assigns it a trust score of 0/100, further supporting its malicious classification. One of 91 security vendors on VirusTotal flags this domain, though the specific detection context remains unverified. The domain's scam type is explicitly identified as a crypto scam, with Ledger confirmed as the impersonated brand. No additional details regarding the phishing kit, specific attack vectors, or user interaction patterns are currently available. Defenders should prioritize blocking access to this domain and monitoring for related infrastructure, particularly Firebase-hosted subdomains impersonating cryptocurrency services. Given the domain's active status and confirmed brand impersonation, takedown procedures should be initiated with Google LLC's abuse reporting mechanisms.