de-coinledger[.]com

This domain is flagged as a high-risk credential harvesting site targeting Ledger hardware wallet users. Analysis indicates the infrastructure is designed to impersonate legitimate Ledger security pages, specifically presenting a 'Securing access' page title to deceive victims into entering recovery phrases or private keys. The threat type falls under brand impersonation with direct financial fraud intent, as compromised wallet credentials would enable unauthorized cryptocurrency transfers. Infrastructure analysis reveals the domain de-coinledger.com was registered on May 17, 2024, through CNOBIN INFORMATION TECHNOLOGY LIMITED and currently resolves to IP address 193.169.194.12. Security telemetry shows the domain appears on 3 blocklists and is flagged by 17 of 95 security vendors on VirusTotal. The absence of an SSL certificate further reduces trust indicators, while the page title 'Securing access' directly mimics legitimate wallet security verification processes. Current status remains active with no takedown observed. Mitigation requires immediate blocking of the domain and its resolving IP address across all network security controls. Users who may have interacted with this domain should assume credential compromise and immediately transfer assets to new wallet addresses using fresh recovery phrases. Organizations should monitor for connections to 193.169.194.12 and alert any users who accessed the domain. Cryptocurrency service providers should preemptively revoke access for any accounts associated with this phishing infrastructure, as credential harvesting typically precedes immediate fund theft attempts.