ledger[.]co[.]com

Analysis of the domain ledger.co.com indicates a targeted brand impersonation campaign against Ledger, a recognized cryptocurrency hardware wallet provider. The domain was registered on February 21, 2026, and resolves to the IP address 217.114.42.68, hosted under AS57724 (DDOS-GUARD LTD) in Russia. This infrastructure has been previously associated with malicious activity, as reflected in a Gridinsoft trust score of 0 out of 100. The domain appears on one security blocklist and is currently blocked by PhishDestroy.

As of July 22, 2026, the domain has been taken offline, though its prior HTTP response presented a page titled 'ledger.co.com | Leading Blockchain Technology Conference 2026,' which does not align with Ledger’s core business of hardware wallets but suggests an attempt to exploit blockchain-related interest. VirusTotal detection data shows that one of ninety-three security vendors flagged the domain, though the specific detection rationale remains unverified. The SSL certificate is issued by R11, a certificate authority not commonly associated with legitimate enterprise domains. No evidence of a phishing kit or additional malicious payloads has been confirmed, and the exact content of the site beyond its page title is not yet analyzed.

Defenders are advised to monitor subdomains under co.com for similar impersonation attempts, particularly those leveraging blockchain or cryptocurrency themes. Organizations should update blocklists to include this domain and investigate any prior connections from internal networks to the IP 217.114.42.68. Given the domain’s offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential incident response.