ledger-contact[.]info

The domain ledger-contact.info was flagged as a Ledger brand impersonation campaign and is currently offline. Registration data shows the domain was created through the registrar identified as AMAZO-4, which maps to ASN 16509 owned by Amazon.com, Inc. The authoritative nameservers are ns21.domaincontrol.com and ns22.domaincontrol.com, both typical of GoDaddy’s DNS service. DNS resolution points to the IP address 76.223.105.230, a host located in the United States and also assigned to ASN 16509, indicating the infrastructure is hosted on Amazon cloud services. No TLS certificate is presented; the site responded without HTTPS, which is consistent with many low‑cost phishing deployments. The page title returned by the HTTP response is “Ledger Contact”, directly referencing the targeted brand.

Threat intelligence sources list the domain on one security blocklist and record it in a single AlienVault OTX pulse. The domain is also listed as blocked by the PhishDestroy service and received a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans show four of ninety‑five security vendors flagged the domain, reinforcing the suspicion despite the low detection count. The scam type is categorized as a crypto scam, suggesting that any user‑facing content would likely attempt to solicit cryptocurrency payments or credentials.

While the site is presently taken offline, the observed infrastructure components—Amazon‑hosted IP, GoDaddy DNS, lack of SSL, and the Ledger‑related page title—provide a clear indicator set for detection rules. Defenders should add ledger-contact.info to blocklists, enforce DNS sink‑holing for its IP range, and monitor for future domains that resolve to the same Amazon ASN with similar naming patterns. Continuous re‑scanning of the domain with multiple AV engines is advisable in case the site is resurrected.