clients-ledger[.]com

The domain clients-ledger.com is associated with a phishing scam involving brand impersonation of Ledger, a well-known cryptocurrency hardware wallet provider. This domain was specifically set up to imitate Ledger and target users in the cryptocurrency sector. As of now, clients-ledger.com has been taken offline, reducing its immediate threat, but evidence suggests it was previously active in attempts to deceive users.

Technical analysis reveals that 11 of 95 VirusTotal security vendors, including alphaMountain.ai, Certego, and CRDF, detected clients-ledger.com as malicious. The domain was registered via Dominet (HK) Limited on November 02, 2025, and resolves to IP address 80.66.87.123, located in Germany under AS216127 INTERNATIONAL HOSTING COMPANY LIMITED. The domain appears on one security blocklist (PhishDestroy) and was found in one AlienVault OTX threat intelligence pulse. No SSL certificate was present, and the site had no observed page title. The Gridinsoft trust score is 0/100, and the HTTP status code observed is 429. Nameservers used are a.dnspod.com, b.dnspod.com, and c.dnspod.com.

Anyone who interacted with clients-ledger.com should assume their credentials or sensitive information may be compromised. Since the scam type is cryptocurrency-related but no drainer kit is confirmed, users should immediately change any passwords associated with Ledger or related accounts, enable two-factor authentication, and monitor for fraudulent activity. Reporting the incident to the impersonated brand Ledger and to relevant cybersecurity authorities is also recommended.