ledgerhq[.]nz

Analysis of ledgerhq.nz indicates active brand impersonation targeting Ledger. The site returns HTTP 200 and presents the page title “Ledger • Write Once. Trust Forever.”, matching the legitimate Ledger branding, yet the domain is unrelated to Ledger’s official infrastructure. Infrastructure analysis shows the domain resolves to IP 188.114.96.3, which is hosted by CloudFlare, Inc. in Canada, and the TLS certificate is issued by Google Trust Services under the WE1 authority, a common configuration for compromised or phishing sites that employ reputable CAs to gain user trust. Threat intelligence sources flag the domain in 20 AlienVault OTX pulses and it appears on a single security blocklist; PhishDestroy has already blocked it. VirusTotal scans report three detections out of 91 security vendors, confirming malicious activity despite the majority of scanners not flagging it. The evidence confirms the domain is being used to impersonate Ledger, but the specific payload or credential‑harvesting mechanism has not been publicly disclosed. Defenders should block DNS resolution to 188.114.96.3, add ledgerhq.nz to web filtering and email security policies, and monitor for any related credential submissions targeting Ledger users. Continuous scanning of the domain with updated malware scanners is recommended to capture any evolving threats.