en-ledger[.]to

This domain, en-ledger.to, was registered on May 25, 2025 through Spaceship, Inc. and is currently taken offline. DNS resolution points to the IPv4 address 190.115.24.11, which belongs to AS59692 IQWeb FZ-LLC and is geolocated to Belize. The web server presents no TLS certificate, indicating only HTTP access. The sole page title retrieved from the host is “Website 190.115.24.11 is ready. The content is to be added”, providing no substantive content about the alleged service. VirusTotal records show that 13 of 95 AV and URL scanning engines have flagged the domain as malicious.

Independent reputation services assign extremely low trust scores: Gridinsoft rates it 0 out of 100, and Scamadviser rates it 1 out of 100. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed. AlienVault OTX includes the domain in one threat‑intel pulse, corroborating its association with malicious activity. The domain is explicitly linked to Ledger through the “Impersonates: Ledger” tag and is classified as a crypto‑scam, suggesting attempts to lure victims into providing cryptocurrency credentials or payments. Publicly available evidence does not include a captured landing page, phishing kit details, or active command‑and‑control infrastructure, so the exact attack vector remains unknown.

The current offline status may be temporary; historical use indicates the infrastructure can be re‑activated. Defenders should add 190.115.24.11 to network‑level deny lists and enforce DNS filtering for en-ledger.to. Monitoring of the registrar Spaceship, Inc. for new domains that share the same name pattern is advised. Security teams should incorporate the domain into endpoint and web‑proxy threat feeds, and review any alerts that reference Ledger‑related credential or payment requests. Continuous re‑evaluation of the domain’s status on blocklists and threat‑intel platforms is recommended to capture any resurgence.