welcome[.]ledgerr[.]us

This domain is flagged for elevated-risk brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The threat involves a fraudulent website designed to deceive users into believing they are interacting with legitimate Ledger infrastructure, likely to facilitate cryptocurrency theft or credential harvesting. The specific threat type is brand impersonation, with no evidence of a crypto drainer or fake login portal at the time of analysis, though the page title 'Clock error' suggests a potential technical misconfiguration or obfuscation tactic. Infrastructure analysis reveals the domain welcome.ledgerr.us was registered on April 23, 2025, through GoDaddy.com, LLC, and resolves to the IP address 132.148.178.194, hosted within AS26496 (GoDaddy.com, LLC) in the United States. The domain appears on one security blocklist and is flagged by 11 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. The SSL certificate is issued by Let's Encrypt (R12), a common certificate authority used by both legitimate and malicious actors. The domain has since been taken offline, though its prior activity and registration details remain relevant for threat correlation. Mitigation steps for this threat type include blocking the domain and its associated IP address at the network perimeter to prevent user access. Organizations should monitor for internal connections to the domain or IP, particularly from systems handling cryptocurrency transactions. End users should be educated on verifying domain authenticity before interacting with cryptocurrency-related websites, including checking for HTTPS validity, domain spelling, and official branding. Security teams are advised to review logs for prior connections to 132.148.178.194 or the domain and correlate with any reported incidents of cryptocurrency theft or unauthorized access.