ledgers-crypto[.]com

This domain is flagged for brand impersonation targeting Crypto.com, a cryptocurrency exchange platform. The threat type involves fraudulent replication of legitimate financial services to deceive users into disclosing sensitive credentials or transferring assets. Analysis indicates an elevated risk level due to its deceptive infrastructure and active distribution methods. Infrastructure analysis reveals the domain was registered on May 29, 2024, through Ultahost, Inc., and resolves to the IP address 104.21.38.228. It appears on three security blocklists and is blocked by multiple threat intelligence feeds, including MetaMask and PhishDestroy. The domain has a Gridinsoft trust score of 0/100 and is flagged by 4 out of 95 security vendors on VirusTotal. Detected technologies include WordPress, MySQL, PHP, Weglot, Slick, jQuery Migrate, jQuery, and Cloudflare Browser Insights. The page title, 'LEDGER GLOBAL | Trading Platform for Stocks, Crypto,' explicitly mimics financial service branding to enhance credibility. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should update endpoint protection rules to detect and prevent access to the domain. Users should be educated on recognizing brand impersonation tactics, particularly those involving cryptocurrency platforms. Security teams are advised to monitor for similar domains registered through the same registrar or resolving to the same IP range. Incident response protocols should include verification of any financial transactions linked to this domain, as it may indicate compromised accounts or attempted fraud.