startledh[.]gl

Analysis of startledh.gl indicates a confirmed brand‑impersonation operation targeting Ledger users. The domain was registered on 28 November 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.221.39 located in the United States. No SSL certificate is present, leaving the site exposed to clear‑text interception. The authoritative nameservers dion.ns.cloudflare.com and miki.ns.cloudflare.com resolve the domain to the Cloudflare edge, a common choice for malicious actors seeking rapid deployment and automated takedown resistance.

The page title returned by the server is "Ledger Accounting System," directly referencing the Ledger brand and reinforcing the impersonation claim. Gridinsoft assigns a trust score of 0 / 100, indicating a high likelihood of malicious intent. VirusTotal reports that six of ninety‑five scanning engines flagged the domain, providing additional corroboration of suspicious activity. The site has been listed on one security blocklist and was previously blocked by PhishDestroy, confirming that defensive feeds have identified it as hostile.

Current monitoring shows the domain is offline, suggesting the operator may have withdrawn the site after detection. Uncertainty remains regarding the exact payload delivered to victims, as no page content or malware sample has been disclosed. Defenders should continue to block the domain at perimeter devices, update URL filtering lists, and monitor for any re‑registration attempts or similar domains using the same registrar or naming patterns. Incident response teams should also advise Ledger customers to verify official URLs and avoid entering credentials on any site lacking a valid TLS certificate or that displays the "Ledger Accounting System" title without proper Ledger branding.