wlf-ledger[.]org

The domain wlf-ledger.org was registered on 2026-02-21 through TuringSign Inc. d/b/a Cosmotown and resolves to 157.90.1.27, an address in Germany owned by AS24940 Hetzner Online GmbH. It is served by LiteSpeed and returns HTTP 200 with a valid Let’s Encrypt R12 certificate. Passive scans reveal a stack of PHP‑based web applications using particles.js, Leaflet, Chart.js, Material Design Lite, Bootstrap and Swiper. The page title “Home | World liberty Finance ledger” suggests an attempt to impersonate a financial service, consistent with the reported brand‑impersonation and cryptocurrency scam classification. The domain appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask and SEAL. VirusTotal reports 14 of 93 AV engines flag the host as malicious. Additional indicators include MX records pointing to the same domain and a Gridinsoft trust score of 0/100. The infrastructure, registration details and detection history confirm a high‑risk, active malicious site. Defenders should block the domain at DNS and proxy layers, monitor traffic to 157.90.1.27, and enforce email filtering for messages using the wlf-ledger.org MX. Ongoing observation is advised to detect any future payload changes or credential‑harvesting pages, as the current content has not been publicly inspected.