burnledger[.]space

This domain, burnledger.space, is flagged as a high-risk brand impersonation targeting Ledger cryptocurrency users. The domain was registered on March 16, 2026, through Key-Systems LLC, and its infrastructure is hosted in the United States on AS701 Verizon Business, resolving to IP address 138.88.4.74. The page title, 'Burn Ledger,' directly mimics the legitimate Ledger brand, indicating a phishing or scam operation aimed at stealing cryptocurrency credentials or assets. The domain uses a Let's Encrypt SSL certificate (E8), which provides HTTPS but does not authenticate the site's legitimacy, and is served via Caddy with HSTS and HTTP/3 support. VirusTotal analysis shows 7 out of 95 security vendors flagging this domain as malicious, and it appears on one security blocklist (PhishDestroy). The Gridinsoft trust score is 0 out of 100, confirming widespread distrust. The nameservers (ns.second-ns.com, ns1.your-server.de, ns3.second-ns.de) suggest a multi-jurisdictional hosting setup, possibly to evade takedown efforts. The domain is currently active and returning HTTP status 200, meaning the phishing page is live and accessible to potential victims. Defenders should block this domain and IP address at the network level, add it to threat intelligence feeds, and warn users about the impersonation. Uncertainties include the exact phishing mechanism (e.g., credential harvesting via fake login forms or malware distribution) and the full scope of the operation, as no phishing kit or email campaign data is available in the known intelligence. Analysts should monitor for related domains, subdomains, or IP changes, and report to hosting providers for takedown. Users who may have interacted with this site should rotate their Ledger credentials and enable two-factor authentication immediately.