public[.]ledgerr[.]us

This domain, public.ledgerr.us, is identified as a brand impersonation threat targeting the Ledger brand. The site poses a significant risk to users by attempting to deceive them into believing they are interacting with a legitimate Ledger service. If visited, users may be prompted to provide sensitive information, such as login credentials or personal data, which can be used for malicious purposes.

Analysis indicates that public.ledgerr.us was created on February 21, 2026, and is registered through GoDaddy.com, LLC. The domain resolves to the IP address 132.148.178.194, which is located in the United States and is associated with the autonomous system AS26496. The site's SSL certificate is issued by Let's Encrypt / R12, which does not inherently indicate malicious intent but is commonly used by threat actors for legitimacy. VirusTotal reports that 13 out of 95 security vendors have flagged this domain as malicious, and it appears on one security blocklist, specifically PhishDestroy.

If a user has visited public.ledgerr.us, they should immediately change their Ledger account passwords and enable two-factor authentication (2FA) if not already in place. Users should also monitor their financial accounts and credit reports for any unauthorized activity. It is recommended to run a full system scan using updated antivirus software and to report the incident to Ledger's official customer support. For future reference, users should always verify the URL of any site requesting sensitive information and avoid clicking on suspicious links.