ledgerwalletcommunity[.]com

Analysis indicates that ledgerwalletcommunity.com was registered on 17 June 2026 and is currently offline. The domain resolves to 176.123.0.199, an address allocated to AS200019 (ALEXHOST SRL) in Moldova. DNS configuration shows Cloudflare authoritative nameservers irma.ns.cloudflare.com and peter.ns.cloudflare.com, and a single MX entry with priority 0 pointing to _dc-mx.5250466f8a3f.ledgerwalletcommunity.com, suggesting possible use of a custom mail routing service. The site presented a TLS certificate issued by Let’s Encrypt (YR1), confirming HTTPS support, and the observed page title was “Ledger - Update”, aligning with the declared brand target Ledger and the classification of brand impersonation. Web‑server fingerprints reveal PHP running behind LiteSpeed with HTTP/3 enabled, a stack commonly observed in phishing infrastructure.

Reputation services report a Gridinsoft trust score of 0/100 and detection by one security blocklist. VirusTotal scans returned 13 positive detections out of 91 vendors, and the domain is listed as blocked by PhishDestroy. The registrar listed is Hosting Concepts B.V. d/b/a Registrar.eu. No additional public threat‑intel feeds are referenced in the supplied data. Uncertainty remains regarding the exact payload or credential‑collection mechanisms, as the page content has not been captured.

The presence of a legitimate‑looking page title and a valid TLS certificate may increase user trust, but the low trust score and multiple vendor detections indicate malicious intent. Defenders should continue to block the IP address 176.123.0.199, add the domain to local allow‑list exclusions, and monitor for any resurgence of the domain or similar patterns in newly registered domains targeting Ledger. Network sensors should flag outbound connections to the identified IP and Cloudflare nameservers, and email filters ought to scrutinize messages using the observed MX host.