xn--ledger-gj7k537u[.]com

This domain, xn--ledger-gj7k537u.com, is identified as a brand impersonation threat targeting Ledger, a manufacturer of cryptocurrency hardware wallets. The site presents itself as a legitimate platform for secure crypto storage, with a page title in Chinese: "Ledger硬件钱包 - 加密货币安全存储 2026." The content and branding are designed to deceive users into believing they are interacting with an official Ledger service, likely to harvest sensitive information such as recovery phrases or private keys. Analysis indicates the domain was registered on March 13, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to the IP address 172.67.197.107 and is associated with a Let's Encrypt SSL certificate (serial number E7). VirusTotal reports 3 out of 95 security vendors flagging this domain as malicious. The domain appears on one security blocklist, though it is not currently listed on Google Safe Browsing. The use of an internationalized domain name (IDN) with non-ASCII characters may further obscure its malicious intent from casual users. As of the latest assessment, the domain has been taken offline, reducing immediate exposure. However, residual risk persists due to the potential for re-registration or migration to alternative infrastructure. Users who accessed this domain are advised to monitor for unauthorized transactions, rotate any exposed credentials, and verify hardware wallet integrity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.