download-ledger[.]app

The domain download-ledger.app is a cryptocurrency phishing site engaged in brand impersonation targeting Ledger, a well-known hardware wallet provider. It poses an elevated risk by mimicking Ledger’s official branding to deceive users into disclosing sensitive information or transferring cryptocurrency to attacker-controlled wallets. No drainer kit was identified, but the site’s intent aligns with cryptocurrency scams. As of the latest verification, download-ledger.app has been taken offline.

Technical indicators confirm the domain’s malicious nature. download-ledger.app was flagged by 1 of 95 VirusTotal security vendors, including Fortinet, and appears on 1 security blocklist (PhishDestroy). The domain is registered through Cloudflare, Inc., with nameservers arturo.ns.cloudflare.com and sue.ns.cloudflare.com. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335) in the US. No SSL certificate was observed, and the page title displayed a '404 Not Found' error during analysis. Gridinsoft assigned a trust score of 0/100, further indicating its fraudulent purpose.

Users who interacted with download-ledger.app should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Report the domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand’s security team to aid in takedown efforts. Monitor financial and cryptocurrency accounts for unauthorized transactions.