ledger-co[.]dream[.]space

Analysis of ledger-co.dream.space, created on 21 February 2026 and registered through Go Daddy, LLC, shows a high‑risk crypto‑related impersonation of the Ledger brand. The site is listed on one security blocklist and is actively blocked by PhishDestroy, indicating that defensive feeds have already identified it as malicious. VirusTotal reports 11 of 93 scanning engines flagging the domain, reinforcing the suspicion. The domain resolves to IP 104.18.20.20, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Nameservers oaklyn.ns.cloudflare.com and titan.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure.

TLS termination is provided by Google Trust Services under the WE1 certificate, suggesting a valid‑looking HTTPS connection. An HTTP 302 redirect is observed, and the final page title reads “Ledger.com/start Download – Setup Ledger Wallet”, directly referencing the Ledger brand and aligning with the declared scam type “Crypto Scam”. Detected front‑end libraries include Three.js, ECharts, Tailwind CSS, jsDelivr, cdnjs, and HSTS, all typical of modern web stacks but not indicative of benign intent. The page is associated with the “Seed Phrase Phishing” kit, a known template used to harvest cryptocurrency seed phrases.

Gridinsoft assigns a trust score of 0 / 100, reflecting an extremely low reputation. While the visible content has not been captured, the combination of brand impersonation, malicious kit attribution, blocklist presence, and multiple vendor detections provides strong evidence that the domain is being used to lure Ledger users into disclosing private keys or installing fraudulent wallet software. Defenders should block the domain at network perimeter, add the IP address to deny‑list policies, monitor DNS queries for the associated nameservers, and update endpoint detection rules to flag any process attempting to download or execute files matching the page title.