synchlegder-live[.]help

Analysis of the domain synchlegder-live.help indicates it was actively used for wallet seed phishing targeting Ledger users. The domain was registered on February 21, 2026, through Dynadot LLC and resolved to the IP address 192.185.33.172, hosted on AS19871 (Network Solutions, LLC) in the United States. Its nameservers—hgns1.hostgator.com, hgns2.hostgator.com, ns8061.hostgator.com, and ns8062.hostgator.com—suggest shared hosting infrastructure commonly exploited for phishing campaigns. The page title, 'IMPORT YOUR WALLET,' aligns with known tactics used to deceive users into submitting cryptocurrency wallet recovery phrases. The domain appears on one security blocklist and is referenced in two AlienVault OTX threat intelligence pulses, confirming its classification as malicious by multiple sources.

Twelve of 93 security vendors on VirusTotal flagged the domain, reinforcing its association with fraudulent activity. No SSL certificate was detected, a common red flag for phishing sites. The domain has since been taken offline, though its prior hosting and detection history remain relevant for historical threat analysis. Defenders should treat this domain as part of a broader wallet phishing campaign.

While the site is no longer active, its infrastructure—including the IP and nameservers—may be reused in future attacks. Organizations monitoring for Ledger-related threats should include this domain in retrospective scans and blocklists. The absence of an SSL certificate and the use of HostGator nameservers further support its classification as high-risk infrastructure. No evidence suggests this was part of a larger phishing kit or affiliate network, but the scam type (wallet/seed phishing) is consistent with prior Ledger impersonation schemes.