us-ledgor-start-com[.]square[.]site

Analysis indicates that the domain us-ledgor-start-com.square.site is actively hosting a brand impersonation campaign targeting Ledger. The site returns HTTP 200 and presents a page title matching the official Ledger start page, suggesting an attempt to lure users seeking Ledger onboarding resources. Infrastructure evidence shows the domain resolves to IP 74.115.51.5, hosted in the United States and associated with Weebly, Inc. The SSL certificate is issued by Let’s Encrypt (identifier YE2), and the domain is registered through MarkMonitor Inc. The domain is listed on three public blocklists and has been flagged by security vendors PhishDestroy, MetaMask, and SEAL. VirusTotal reports 13 of 91 scanners identifying the domain as malicious. Nameserver configuration includes ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, and ns-311.awsdns-38.com. The campaign remains active as of the report date. defenders should block the domain at perimeter filters, monitor DNS queries for the associated IP and nameservers, and flag any traffic to the URL as suspicious. Additional investigation of the landing page content is recommended to confirm credential capture mechanisms, but current evidence already warrants inclusion in phishing mitigation controls.