ledger20[.]com

ledger20.com is an active domain created on 21 February 2026 and currently resolves to 147.45.45.218, an IP address assigned to NEON CORE NETWORK LLC in the Netherlands (AS205775). The domain is served through Cloudflare DNS (ashton.ns.cloudflare.com, heather.ns.cloudflare.com) and presents a Google Trust Services / WE1 SSL certificate. HTTP requests receive a 301 redirect response. Infrastructure analysis shows the site runs a mixed stack including WordPress, MySQL, PHP, Node.js, Express, and third‑party components such as Yoast SEO, theTradeDesk and Taboola. The domain is registered via NiceNIC International Group Co., Limited. Threat intelligence flags the domain as a high‑risk brand‑impersonation crypto scam targeting Ledger; it appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans report 20 of 93 security vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of 0/100. While the exact content of the site has not been captured, the combination of recent registration, use of trusted SSL, redirection, and known malicious detections indicate a deliberate attempt to deceive users seeking Ledger services. Defenders should block DNS resolution and TLS connections to 147.45.45.218, add ledger20.com to URL filtering and email security policies, and monitor for related indicators such as the Cloudflare nameservers and the observed technology stack. Additional investigation should focus on retrieving the page content and any associated payloads to confirm the impersonation tactics.