ledger[.]ownbitcoins[.]net

The domain ledger.ownbitcoins.net is flagged as a high‑risk brand‑impersonation infrastructure targeting the Ledger brand. The site presents a page titled "Ledger Nano X: Mobile‑first day‑to‑day use | Ledger" and is classified under cryptocurrency‑related scams. Active monitoring shows the domain remains reachable and serves content over HTTPS, confirming its continued operation.

Infrastructure analysis reveals the domain was registered on 17 December 2014 through Tucows Domains Inc. It resolves to the IP address 76.76.21.241, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. The hosting environment uses Vercel‑provided services, as indicated by the presence of Next.js, React, Node.js, Contentful, Global‑e, and OneTrust, and enforces HSTS. DNS is served by ns1.hosting24.com and ns2.hosting24.com. The TLS certificate is issued by Let’s Encrypt (R13), confirming a valid but freely‑issued certificate.

Threat intelligence sources corroborate the malicious nature of the domain. VirusTotal reports two security vendors flagging the site out of ninety‑five scanned, and the domain appears on a single security blocklist. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy lists the domain as blocked. An HTTP 301 response indicates a permanent redirect, which may be used to funnel traffic to a credential‑harvesting endpoint. No additional content analysis is available beyond the page title, leaving the exact phishing mechanics unverified.

Defenders should prioritize blocking ledger.ownbitcoins.net at DNS and proxy layers, enforce outbound filtering to the associated Amazon IP range, and monitor for any traffic patterns that match the observed technology stack. Continuous re‑assessment of the site’s content is advised, as the current evidence points to a sophisticated brand‑impersonation campaign leveraging legitimate cloud services to increase credibility.