ledgerworld[.]world

Analysis of the domain ledgerworld.world confirms active brand impersonation targeting Ledger, a recognized hardware wallet provider. The domain is currently resolving to IP address 188.114.96.3 and is registered through Dynadot LLC. The page title, 'LedgerWorld - Váš partner pro komplexní účetní služby v ČR,' suggests localization for Czech audiences, though the content and intent remain unconfirmed beyond the title. Infrastructure analysis reveals the use of Cloudflare, which may obscure hosting details and complicate takedown efforts. Additional technologies detected include Tailwind CSS, Alpine.js, Unpkg, jsDelivr, and Google Analytics, indicating a modern, potentially interactive web presence designed to mimic legitimate services. Threat intelligence aggregators have flagged this domain in 23 distinct pulses, and it appears on at least two security blocklists, including PhishDestroy and BLP-Malware. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. While only 2 of 95 security vendors on VirusTotal have flagged the domain, this limited detection does not diminish the observed threat indicators. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy but is not indicative of trustworthiness in this context. Defenders should prioritize blocking or monitoring traffic to this domain, particularly in environments where Ledger-related services are used. The domain's active status and clear impersonation intent warrant immediate action, including reporting to relevant abuse channels and updating endpoint protection rules. Further investigation into the domain's backend infrastructure and associated threat actor activity is recommended to assess the full scope of the campaign.