promo[.]travelledger[.]org

Analysis of the domain promo.travelledger.org indicates active brand impersonation targeting Ledger, a known cryptocurrency hardware wallet provider. The domain was registered on January 23, 2018, through NETWORK SOLUTIONS, LLC, and currently resolves to the IP address 185.158.133.1, located in Germany. Infrastructure analysis reveals the use of Cloudflare and HSTS, alongside nameservers ns15.worldnic.com and ns16.worldnic.com. The page title, 'Virtual Cards | Travel Ledger - Smart Payment Solutions for Travel,' suggests an attempt to mimic financial or payment services, though the exact content and functionality of the site remain unconfirmed as no direct inspection has been conducted. Security vendors have flagged this domain, with 2 out of 91 detecting it as malicious on VirusTotal. Additionally, it appears on one security blocklist and is blocked by PhishDestroy. The domain returns an HTTP 302 redirect status, which may indicate an attempt to obscure its final destination or evade detection. Gridinsoft assigns it a trust score of 0/100, further supporting its classification as high-risk. The SSL certificate is issued by Google Trust Services (WE1), a common but not inherently suspicious provider. Defenders should treat this domain as an active threat. Network-level blocking of 185.158.133.1 and the domain itself is recommended. Given the impersonation of Ledger, monitoring for related phishing campaigns targeting cryptocurrency users is advised. No evidence currently links this domain to a specific phishing kit or broader campaign, and further forensic analysis would be required to determine its exact payload or distribution methods.