ledgerwalleet[.]webador[.]com

Analysis of the domain ledgerwalleet.webador.com confirms its classification as an active crypto phishing site targeting Ledger, a hardware wallet provider. The domain was registered on January 31, 2016, through Hosting Concepts B.V. d/b/a Registrar.eu, though its malicious use appears to be recent. Infrastructure analysis reveals the site is hosted on IP address 34.90.225.198, located in the Netherlands under AS396982 (Google LLC), with nameservers ns-cloud-e1.googledomains.com, ns-cloud-e2.googledomains.com, and ns-cloud-e3.googledomains.com. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. The page title, 'Ledger wallet | Sign In,' explicitly indicates an attempt to impersonate Ledger's authentication interface. Detection data from security vendors supports this assessment, with 16 of 95 engines on VirusTotal flagging the domain as malicious. The domain is also listed on two security blocklists, including PhishDestroy and PhishingDB, and has been assigned a trust score of 0/100 by Gridinsoft. Technologies detected on the domain include JouwWeb and Nginx, which are not inherently malicious but are frequently used in phishing infrastructure. While the domain's registration date predates its malicious activity, this is not uncommon for repurposed domains. The HTTP status code 200 confirms the site is currently accessible. Defenders should treat this domain as high-risk and implement blocking measures at the DNS or network level. Further investigation into associated infrastructure, such as hosting providers or linked domains, may reveal additional components of this campaign. The exact content of the phishing page remains unanalyzed, but the available evidence strongly supports its classification as a crypto scam targeting Ledger users.