assistance-ledger[.]com

This domain was observed as part of a crypto‑related brand‑impersonation campaign targeting Ledger users. assistance-ledger.com was registered on February 21 2026 through OwnRegistrar, Inc. and resolves to the Cloudflare‑owned address 104.21.48.131, which is announced by AS13335 in the United States. No TLS certificate is presented, indicating that the site was served without HTTPS encryption at the time of capture. The page title returned from the HTTP response reads “Ledger Support – How can we help you?”, directly referencing the Ledger brand and suggesting a support‑center façade. VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion of abuse.

Independent blocklist monitoring reports one inclusion, and the domain is currently listed by PhishDestroy, confirming that community‑driven defenses have identified it as a threat. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, which aligns with the other indicators of compromise. The infrastructure relies on Cloudflare’s DNS service, as evidenced by the authoritative nameservers lia.ns.cloudflare.com and will.ns.cloudflare.com. This arrangement provides the attacker with rapid domain‑level flexibility while obscuring the underlying hosting environment. No SSL certificate was detected, so traffic to the site would have been exposed to interception, but the primary malicious intent appears to be credential harvesting or crypto‑asset fraud rather than data exfiltration.

Defenders should block the domain at network perimeter and update URL filtering lists to include assistance‑ledger.com. Incident response teams encountering related phishing emails should treat any URLs pointing to this domain as malicious and advise users not to submit Ledger credentials or payment information.