ldg[.]co[.]com

This domain ldg.co.com is currently active and hosted on an IP address 87.58.204.177 that resolves to a server located in Finland. The web server reports an HTTP 200 response and is identified as running Nginx. The site presents the page title “Site is being set up…”, which suggests that the content is either placeholder or intentionally minimal. The domain is protected by a Let’s Encrypt certificate issued in the current year (YR1), indicating that TLS is in place but does not provide any reputation benefit. Registration information shows that the domain was created through Moniker Online Services LLC, a registrar commonly used for disposable or short‑lived infrastructure.

At the time of analysis the domain appears on three independent security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal scanning reports that three of ninety‑one security vendors have flagged the domain, reinforcing the suspicion of malicious use. The authoritative name servers listed are ns1.nic.co.com through ns4.nic.co.com, which are typical for the .co.com sub‑domain space and do not reveal additional infrastructure. The combination of an active HTTPS site with a generic “site is being set up” title, low detection count on VirusTotal, and inclusion on multiple phishing blocklists points to a likely phishing campaign, although the specific target or payload has not been disclosed. Uncertainty remains regarding the exact malicious functionality, as no login page, credential capture form, or brand impersonation has been observed in the available data.

Defenders should block network connections to 87.58.204.177 and add ldg.co.com to local deny lists. Monitoring of DNS queries for the four associated name servers is advised to detect any rapid re‑hosting. Because the domain uses a legitimate TLS certificate, deep packet inspection or TLS fingerprinting may be required to identify traffic.