dpp-ledger[.]com

The domain dpp-ledger.com was registered on May 05, 2026 through the registrar 123-Reg Limited. It resolves to the IP address 13.248.213.45, which is hosted in Canada and appears to be part of an AWS Global Accelerator network. The site presents a valid TLS certificate issued by GoDaddy.com under the GoDaddy TLS Intermediate CA DV - R1v1 chain, and HTTP requests return a 200 status code.

Threat intelligence flags the domain as a brand‑impersonation campaign targeting Ledger. It is listed on three security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is 0 out of 100, indicating a high confidence of malicious behavior. VirusTotal reports four detections out of ninety‑five scanned security vendors, and AlienVault OTX includes the domain in a single threat pulse.

Infrastructure analysis shows the use of a cloud‑based accelerator service, which can obscure the true origin of the server and facilitate rapid scaling. The presence of a legitimate‑looking SSL certificate further enhances the credibility of the site, increasing the likelihood of successful credential harvesting or malicious payload delivery. While the exact phishing page content has not been observed, the combination of brand impersonation, blocklist presence, and low trust score strongly suggests a high‑risk operation.

Defenders should add dpp-ledger.com to blocklists for all outbound and inbound filtering points, monitor DNS queries for this name, and enforce strict TLS inspection to detect any anomalous traffic. Continuous re‑evaluation of VirusTotal and other vendor feeds is recommended, as additional detections may emerge. Organizations that handle Ledger‑related assets should also educate users about the visual similarity of the domain and enforce multi‑factor authentication to mitigate potential credential compromise.