support-recoveryledger[.]com

This domain is flagged for elevated risk due to brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The site mimics official Ledger support infrastructure, specifically the Ledger Live application, to deceive users into disclosing sensitive recovery phrases or credentials. Analysis indicates this is a targeted credential harvesting operation with potential financial fraud objectives. Infrastructure analysis reveals the domain support-recoveryledger.com was registered on January 05, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. The domain resolves to IP address 190.97.166.172, located in Panama and associated with AS27956 (Cyber Cast International, S.A.). No SSL certificate is present, increasing vulnerability to interception. VirusTotal reports 17 out of 95 security vendors flagging this domain as malicious. The domain appears on one security blocklist and was actively blocked by PhishDestroy. The page title observed was 'Ledger Live,' confirming intent to impersonate official Ledger software. Mitigation requires immediate action from both users and security teams. Users who accessed this domain should assume credential exposure and initiate recovery phrase rotation on their Ledger devices. They should verify all transactions and monitor for unauthorized access. Security teams should update blocklists to include this domain and its resolving IP, and monitor for related infrastructure using the registration pattern (Registrar.eu, Panama-hosted IPs). Ledger users should be reminded that official support channels never request recovery phrases, and all legitimate communications originate from ledger.com or verified subdomains. Domain registrars should be notified for potential takedown under brand protection policies.