ledger[.]com[.]af

The domain ledger.com.af was registered on January 29, 2026 through Web Commerce Communications Limited and is presently taken offline. Technical fingerprinting shows the site was built with PHP and served via LiteSpeed with HTTP/3 support, and it presented a Let’s Encrypt certificate (R13) for HTTPS. DNS resolution points to IP address 198.54.132.28, which belongs to AS11878 tzulo, inc. in Canada. The domain’s MX record is configured to route mail to ledger.com.af itself, and four UltraHost nameservers (ns1‑ns4.ultahost.com) are authoritative.

Reputation scoring is extremely low: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. It has been flagged by PhishDestroy and is cited in a single AlienVault OTX pulse. VirusTotal analysis recorded 23 detections out of 93 scanned scanners, indicating a strong consensus among security vendors that the site is malicious. The page title retrieved during the brief crawl reads "Hardware Wallet & Crypto Wallet - Security for Crypto | Ledger," directly impersonating the Ledger brand and aligning with the classified crypto‑scam profile.

While the site is no longer reachable, the infrastructure evidence—low trust score, multiple vendor detections, blocklist presence, and brand‑specific page title—confirms a deliberate brand‑impersonation campaign targeting Ledger users. Defenders should update internal blocklists with ledger.com.af and its associated IP 198.54.132.28, monitor for any future resolution to new addresses, and enforce email filtering for the domain’s MX configuration. Incident response teams should also audit credential‑reuse patterns for Ledger‑related services and consider notifying affected users of potential credential compromise. Continuous threat‑intel feeds should be queried for any resurgence of the domain or related infrastructure, given the observed persistence of the impersonation vector.