ledger-ai[.]modernizing-apps[.]com

Analysis of ledger-ai.modernizing-apps.com shows a short‑lived domain created on 21 February 2026 that was used to impersonate the Ledger brand in a crypto‑related scam. The site returned an HTTP 404 status and its page title was limited to the domain string itself, indicating no substantive content was served before the infrastructure was taken offline. DNS resolution points to 34.111.179.208, an address owned by Google LLC (AS396982) and hosted on Google Cloud, with the domain’s name servers hosted on the standard Google Domains cloud set (ns‑cloud‑e1 to e3). The TLS certificate is issued by Let’s Encrypt (E8), confirming the use of a free, automated certificate.

Technical fingerprinting identified Node.js, Express, Google Cloud CDN, HSTS, and HTTP/3, consistent with a typical web‑application stack but offering no further clues about malicious payloads. The domain was registered through Squarespace Domains LLC, a common registrar for short‑term deployments. Threat intelligence sources have flagged the domain as a crypto scam, with one of ninety‑three VirusTotal scanners raising an alert, and it appears on a single security blocklist.

PhishDestroy has already taken the site offline, and the current status is marked as offline. Defenders should continue to block the domain and its associated IP address at perimeter and endpoint layers, monitor for any re‑use of the same IP or similar sub‑domains, and add the domain to internal blacklists. Given the limited detection coverage, organizations should also consider adding the domain to threat‑intel feeds and ensure that any user‑initiated connections to ledger‑ai.modernizing‑apps.com are logged and investigated for potential credential exposure.