1m50ku-ledger[.]com

This domain is assessed as elevated risk due to brand_impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The infrastructure is consistent with credential theft or wallet recovery phrase harvesting attempts, as indicated by replicated branding and a matching page title designed to mimic legitimate Ledger services. The domain is currently offline, but historical activity indicates malicious intent aligned with financial account compromise.

Technical indicators show a VirusTotal detection score of 19/95 security vendors flagging the domain. The domain was registered through NiceNIC International Group Co., Limited and created on February 21, 2026. It resolves to IP address 172.67.220.202, hosted in the US under AS13335 Cloudflare, Inc. It appears on 1 security blocklist and is explicitly blocked by PhishDestroy. The domain has no SSL certificate. The reported page title is Hardware Wallet & Crypto Wallet - Security for Crypto | Ledger, and impersonates the Ledger brand.

Although the domain status is currently taken offline, the presence of prior DNS resolution, active impersonation content, and recorded blocklisting indicates prior malicious deployment. Recommended mitigation includes maintaining block rules across DNS, web gateways, and endpoint protections, preserving indicators (domain, IP, registrar, and creation date) for threat hunting correlation, and monitoring for re-registration or infrastructure reuse. Given the elevated risk rating and confirmed impersonation patterns, any future resolution of this domain should be treated as high-confidence malicious activity requiring immediate containment actions.