ledzger[.]com

The domain ledzger.com was registered on 20 June 2025 through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.80.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No SSL certificate is presented for the host, and the site is currently reported as taken offline. Threat intelligence sources identify the domain as a wallet/seed phishing operation that impersonates the Ledger brand.

The infrastructure has been listed on one public security blocklist and is actively blocked by PhishDestroy. AlienVault OTX references the domain in sixteen separate threat pulses, indicating repeated observation across multiple campaigns. VirusTotal scans show that sixteen of ninety‑five antivirus or URL‑reputation engines flagged the domain as malicious. Independent reputation scoring assigns a Gridinsoft trust score of zero out of one hundred, reinforcing the malicious assessment.

The domain uses a single authoritative nameserver, though the specific server name is not disclosed. While the available data confirms a clear association with Ledger‑related credential harvesting, the exact content of the site, HTTP response codes, and page title remain unverified because the service is offline. Defenders should add ledzger.com to blocklists at the DNS and proxy layers, monitor traffic to the associated Cloudflare IP for any residual activity, and ensure that endpoint security solutions are updated to reflect the sixteen detections reported by VirusTotal. Continued observation of OTX pulses and blocklist feeds is recommended to detect any re‑registration or re‑use of the same infrastructure.