ledgifiur[.]gl

The domain ledgifiur.gl was registered on February 21, 2026 and is currently taken offline. DNS resolution points to IP address 172.67.220.174, which is hosted by Cloudflare (AS13335) in the United States. The site served an SSL certificate identified as WE1, indicating the use of a valid TLS layer despite the fraudulent purpose. The page title returned by the server is "Accounting Ledger," and the domain is explicitly listed as impersonating the Ledger brand, aligning with the reported crypto scam classification.

Threat intelligence shows the domain appears on a single security blocklist and is blocked by the PhishDestroy service. VirusTotal scans flagged the domain by four of ninety‑three security vendors, reflecting a modest detection rate, while Gridinsoft assigned a trust score of zero out of one hundred, indicating extreme suspicion. No additional evidence such as malware payloads or credential‑stealing forms has been disclosed.

The observed indicators suggest a short‑lived brand‑impersonation campaign that leveraged a legitimate‑looking TLS certificate and Cloudflare infrastructure to host a crypto‑related scam page. Defenders should continue to monitor the IP address 172.67.220.174 for any re‑use, ensure that URL filtering solutions block ledgifiur.gl, and update intrusion‑detection signatures to flag requests to the domain or its associated IP. Organizations using Ledger services should advise users to verify URLs carefully and to avoid interacting with any site presenting the "Accounting Ledger" title unless it is confirmed as an official Ledger endpoint.