web3ledgersafe[.]com

The domain www.web3ledgersafe.com is currently offline, indicating that the hosting service has been taken down or the site is no longer serving content. Registration data show the domain was created on 21 February 2026 through the Hostinger Operations, UAB registrar, and it points to Amazon’s AS16509 network (IP 216.198.79.1, United States). The authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com, which are typical of parked or abandoned domains. VirusTotal scans have flagged the domain on four of ninety‑five security vendors, providing modest but non‑trivial detection across the threat‑intelligence ecosystem. Independent block‑list providers have added the domain to at least one list, and the anti‑phishing service PhishDestroy has already blocked it, confirming that it has been identified as malicious by multiple sources.

The site’s page title, “Web3 Ledger - Secure Digital Asset Management,” explicitly references Ledger, and the intelligence tags the campaign as a Wallet/Seed phishing attempt that impersonates the Ledger brand. No SSL certificate is presented, which further weakens any claim of legitimacy and makes any data transmitted over HTTP vulnerable to interception. The available data do not include any samples of the malicious payload, phishing landing page content, or observed victim reports, leaving the exact phishing workflow and the effectiveness of the campaign uncertain. Likewise, the lack of a live HTTP response prevents verification of the exact content served, which could affect detection tuning.

Defenders should ensure that their DNS filtering solutions block resolution of 216.198.79.1 when associated with www.web3ledgersafe.com, and they should add the domain to internal blocklists for both inbound and outbound traffic.