ledger-partner-hub[.]com

The domain ledger-partner-hub.com is currently active and serves as a brand‑impersonation vector targeting Ledger. The site presents the page title “Ledger官网入口｜Ledger硬件钱包购买咨询下载售后与正品验证｜沣泽懿”, which directly references Ledger’s official services, indicating a deliberate attempt to mislead users seeking legitimate Ledger hardware wallet resources. Infrastructure analysis shows the domain was registered with Dynadot Inc on 27 April 2026 and resolves to IP 43.154.193.155, an address located in Hong Kong and associated with AS132203 (Tencent Building, Kejizhongyi Avenue). The host runs Nginx with HTTP Strict Transport Security enabled and presents a Let’s Encrypt R13 certificate, a common choice for malicious actors seeking short‑term HTTPS coverage. Reputation signals are poor: Gridinsoft assigns a trust score of 0 / 100, AlienVault OTX lists the domain in two threat‑intelligence pulses, and VirusTotal records 15 detections out of 91 scanners. The domain is already blocked by PhishDestroy and appears on one external blocklist, yet it continues to return HTTP 200 responses. Nameservers ns1.dyna-ns.net and ns2.dyna-ns.net are typical of Dynadot‑hosted domains and provide no additional mitigation clues. While the exact payload or credential‑harvesting mechanisms have not been publicly observed, the combination of a Ledger‑specific page title, low trust scores, multiple security vendor flags, and active hosting suggests a high‑risk impersonation campaign. Defenders should add ledger-partner-hub.com to URL filtering and DNS block lists, monitor outbound traffic for connections to 43.154.193.155, and educate users that any Ledger‑related services should be accessed only through official Ledger domains. Continuous re‑evaluation is advised, as the threat actor may adjust content or infrastructure to evade detection.