docs[.]ledgerr[.]us

Analysis of the domain docs.ledgerr.us indicates that it was registered on 21 February 2026 and is presently taken offline. The site presented a page title identical to the domain name and was observed to use a Let’s Encrypt R12 SSL certificate, suggesting the presence of HTTPS encryption. DNS resolution points to the IP address 132.148.178.194, which belongs to AS26496 operated by GoDaddy.com, LLC and is geolocated in the United States. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service, reflecting recognition by at least one anti‑phishing organization.

VirusTotal reports that 14 of 93 security‑vendor scanners flagged the domain, reinforcing the malicious assessment. A Gridinsoft trust score of 0 out of 100 further indicates a lack of legitimacy. The infrastructure is associated with a crypto‑related scam that impersonates the Ledger brand, as indicated by the brand target field.

No public evidence of the page content beyond the title is available because the site is offline, so the precise tactics employed by the actor remain unknown. Defenders should continue to block the domain at network perimeter and DNS layers, add the IP address 132.148.178.194 to host‑based deny lists, and monitor for any re‑registration of similar Ledger‑related identifiers. Ongoing surveillance of the hosting provider (GoDaddy) for related abusive domains is recommended, as well as periodic re‑scanning of the URL should it become reachable again.