ledgerassets[.]net

The domain ledgerassets.net was registered on 21 February 2026 through NiceNIC International Group Co., Limited. It resolves to the Cloudflare address 172.67.130.56, which is advertised as belonging to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are kay.ns.cloudflare.com and vick.ns.cloudflare.com, confirming that the site is hosted behind Cloudflare’s reverse‑proxy network. No TLS certificate was observed for the domain, indicating that the service is reachable only over plain HTTP or that the certificate is absent at the time of analysis.

The site title returned by the server is “Ledger Wallet — Secure Crypto Wallet,” which does not reference the targeted brand. However, threat intelligence flags the domain as an impersonation of Binance, and the scam type is listed as a Crypto Scam. Ten of ninety‑five VirusTotal scanners flagged the domain as malicious, providing independent vendor confirmation of suspicious activity. The domain appears on a single security blocklist and has been blocked by the PhishDestroy feed, demonstrating that at least one reputable anti‑phishing service has taken action against it.

Current status shows the site as taken offline, which limits immediate exposure but does not remove the underlying infrastructure. Defenders should continue to monitor the IP address 172.67.130.56 for any re‑activation of phishing content, and they should add ledgerassets.net to deny‑list rules in web proxies and email gateways. Because the domain leverages Cloudflare, any future hosting changes may preserve the same IP range, so broader AS‑level blocking may be considered if organizational policy permits. Incident response teams should also update brand‑specific watchlists for Binance‑related impersonation attempts, noting that the attacker has chosen a ledger‑related brand name as a lure.