ledgerbasepro[.]com

Analysis indicates that ledgerbasepro.com was registered through Dynadot LLC on February 21 2026 and is hosted on IP 72.60.39.47, an address belonging to AS47583 Hostinger International Limited located in Germany. The domain resolves to two dynamic DNS servers, ns1.dyna-ns.net and ns2.dyna-ns.net, and presents an SSL certificate issued by Easypanel, a generic hosting‑panel provider. The visible page title “LedgerBasePro – Buchhaltungsverwaltung Schweiz” references Ledger, and the intelligence tags the domain as a brand‑impersonation crypto scam targeting the Ledger brand. VirusTotal scanned the site and two of ninety‑three security vendors flagged it as malicious, while a single external blocklist also lists the domain.

PhishDestroy has already taken the domain offline and the current HTTP response is a 404, indicating no active content at the time of analysis. Defenders should treat the domain as elevated risk despite the offline status. Immediate actions include adding ledgerbasepro.com to URL filtering and proxy blocklists, and optionally blocking the associated IP 72.60.39.47 at the network perimeter. Monitoring of the authoritative name servers for future DNS changes is advised, as the domain could be re‑activated with malicious payloads.

The registrar Dynadot and hosting ASN should be logged for correlation with other suspicious domains. Because the SSL certificate is non‑unique and the page title mimics a legitimate Ledger service, any email or web traffic that references ledgerbasepro.com should be flagged for further investigation. Analysts should also feed the two VirusTotal detections and the blocklist entry into internal threat‑intel platforms to improve detection coverage. Continuous re‑scanning is recommended in case the site becomes active again.