ledgrestart[.]com

This domain, ledgrestart.com, is currently active and classified as a high‑risk brand‑impersonation campaign targeting Ledger users. The site was registered on September 19 2025 through Cloudflare, Inc., and resolves to the Cloudflare address 104.21.47.176 located in the United States under ASN 13335. DNS is served by the Cloudflare nameservers cartman.ns.cloudflare.com and vivienne.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services (WE1), indicating a legitimate‑looking HTTPS connection. The HTTP response returns status 200 and the server advertises HTTP/3, consistent with the observed Cloudflare infrastructure.

The page title returned by the server is “Ledger.com/Start® | Getting started — Ledger”, directly mirroring Ledger’s official branding, which confirms the impersonation intent. The domain is flagged by 16 of 93 VirusTotal scanners, receives a Gridinsoft trust score of 0 / 100, appears on one public blocklist, and is listed in a single AlienVault OTX pulse, all of which reinforce its malicious reputation. PhishDestroy has already added the domain to its blocklist, indicating that at least one anti‑phishing service has taken mitigation action. The listed scam type is “Crypto Scam”, suggesting the site may be used to lure victims into cryptocurrency‑related fraud, although the exact payload or credential‑harvesting mechanism has not been publicly disclosed.

Because the content beyond the page title has not been captured, the precise tactics—such as form‑cloning, malicious downloads, or redirect chains—remain uncertain. Defenders should treat ledgrestart.com as malicious: block the domain at the DNS or proxy layer, add it to URL filtering and email security policies, monitor network traffic for connections to the 104.21.47.176 address, and ensure that any endpoint alerts referencing Ledger brand impersonation are correlated with this indicator.