us-ledger[.]to

The domain us-ledger.to was registered on February 21, 2026 and is currently taken offline. It resolves to the IP address 178.16.54.12, which is geolocated to the Netherlands and belongs to ASN AS202412 owned by Omegatech LTD. The site presents a page title stating "Website 190.115.24.11 is ready. The content is to be added," indicating that no substantive content was observed before the takedown.

VirusTotal analysis shows that fifteen of ninety‑three security vendors flagged the domain, reflecting a moderate detection rate among scanning engines. The domain is listed on a single public security blocklist and has been blocked by the PhishDestroy service, reinforcing its classification as malicious. AlienVault OTX reports the domain in fourteen separate threat‑intel pulses, further corroborating its association with threat activity. The SSL certificate is identified as "R11," a rating that suggests a low trust score, though no additional certificate details are available.

The intelligence explicitly labels the operation as a crypto scam that impersonates the Ledger brand, aligning with the known pattern of brand‑impersonation campaigns targeting cryptocurrency users. While the offline status limits real‑time observation, the convergence of vendor detections, blocklist listings, OTX mentions, and the brand‑impersonation claim provides sufficient evidence for defenders to treat the domain as hostile. Security teams should continue to block the domain at network perimeters, monitor DNS queries for the associated IP, and consider adding the domain to internal blacklists. Ongoing vigilance is advised in case the infrastructure is re‑used under a different domain or IP address, and any future sightings should be correlated with the existing indicators of compromise.