ledger[.]com[.]new

This domain, ledger.com.new, is actively impersonating Ledger, a hardware wallet provider, as indicated by the brand target field and the page title '访问提示' (translated as 'Access Prompt'). Analysis reveals the domain is flagged on two security blocklists and is currently blocked by MetaMask and SEAL. Infrastructure resolves to IP 104.21.7.83, and the SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy due to the prevalence of free certificates in phishing campaigns. VirusTotal reports 3 of 95 security vendors detecting this domain, though this does not confirm malicious activity beyond the provided indicators. The exact content of the site remains unanalyzed, but the combination of brand impersonation, blocklist presence, and active status suggests a high-risk threat targeting cryptocurrency users. Defenders should prioritize blocking this domain at the DNS or network level, alerting users to potential credential harvesting or wallet-draining attempts, and monitoring for related infrastructure tied to the same IP or certificate authority. Further investigation into the hosting provider and registration details may reveal additional linked domains or campaigns.