www-ladger-app[.]app

This domain, www-ladger-app.app, is actively impersonating a cryptocurrency wallet login portal to harvest user credentials and private keys. Analysis indicates the infrastructure is designed to mimic legitimate wallet interfaces, likely targeting users of Ledger or similar hardware wallets. The page title 'Access Restricted' suggests an attempt to create urgency, prompting victims to enter recovery phrases or passwords under false pretenses. Once credentials are submitted, attackers can drain funds from connected wallets, resulting in immediate financial loss for victims. Infrastructure analysis reveals the domain was registered on July 01, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing campaigns. The domain resolves to IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy. As of the latest scan, only 1 out of 95 security vendors on VirusTotal have flagged this domain, indicating low detection rates and potential evasion of automated defenses. No blocklist entries were identified at the time of analysis, further suggesting the infrastructure remains under the radar of many security systems. Users who have visited www-ladger-app.app or entered credentials on the site should immediately revoke access to any connected wallets and transfer assets to a new, secure wallet. All passwords, recovery phrases, and private keys associated with the compromised account must be considered exposed and should no longer be used. Enable multi-factor authentication on all financial and cryptocurrency accounts where possible. Monitor transaction histories for unauthorized activity and report any suspicious transactions to the respective platform. If the browser or device used to access the site is shared or unsecured, perform a full malware scan to rule out additional compromise.