ledger-promotional-platform-2025[.]devplatform[.]fr

ledger-promotional-platform-2025.devplatform.fr was registered through GANDI on 30 November 2018. The domain resolves to the IPv4 address 89.117.116.12, which belongs to AS47583 Hostinger International Limited based in France. The authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com, indicating a generic parking service. The site returns an HTTP 301 redirect and presents a TLS certificate issued by Let’s Encrypt (R12), confirming that transport encryption is in place despite the malicious intent.

The domain appears on one public security blocklist and has been flagged by the PhishDestroy service. VirusTotal analysis shows that 9 of 95 scanned security vendors raise detections, reflecting a moderate level of consensus among scanners. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification.

The page title "Explore exclusive Ledger crypto deals | Ledger" and the declared brand target Ledger reveal a clear brand‑impersonation campaign aimed at cryptocurrency users. The threat type is identified as cryptocurrency brand impersonation, and the risk level is high. No additional content has been observed beyond the title, leaving the exact phishing flow unknown.

Defenders should block the domain and its associated IP address at perimeter and DNS layers, and add the host to threat intelligence feeds. Continuous monitoring of the IP 89.117.116.12 for any change in service or additional domains hosted on the same AS is advised. Because the infrastructure uses widely available hosting and parking services, similar clones may appear, so automated detection rules based on the observed indicators are recommended.