ssl-ledger[.]com

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the Ledger hardware wallet platform. Analysis indicates the site mimics legitimate Ledger services to harvest credentials, private keys, or other sensitive cryptocurrency-related information. The specific threat type—brand impersonation—exploits trust in the Ledger brand to facilitate fraudulent transactions or unauthorized access to digital assets. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain, ssl-ledger.com, was registered on November 05, 2025, through Dominet (HK) Limited, a registrar frequently associated with suspicious domains. It resolves to the IP address 80.66.87.123, hosted under AS216127 (INTERNATIONAL HOSTING COMPANY LIMITED) in Germany. The domain lacks an SSL certificate, a red flag for secure communications. Security vendors on VirusTotal flagged the domain at a 10/95 detection rate, and it appears on three independent security blocklists. Additionally, the domain has been proactively blocked by multiple threat intelligence platforms, reinforcing its classification as a confirmed phishing resource. Mitigation measures should focus on preventing user exposure to this threat. Network-level blocking of the domain and its resolving IP (80.66.87.123) is recommended to prevent access from corporate or personal devices. Users who may have interacted with the domain should immediately revoke any active sessions, rotate credentials, and verify wallet integrity for signs of unauthorized transactions. Organizations should update endpoint protection rules to detect and block domains registered through high-risk registrars like Dominet (HK) Limited, particularly those impersonating cryptocurrency brands. Security teams are advised to monitor for additional domains sharing the same IP or registrar, as these may indicate a broader campaign. Proactive threat hunting for related indicators—such as the creation date, hosting provider, or lack of SSL—can help identify emerging variants of this impersonation scheme.