web3securityledger[.]net

Analysis indicates that the domain web3securityledger.net is actively impersonating Ledger, a well-known hardware wallet provider, as part of a brand impersonation scheme. Registered on May 19, 2026, through DYNADOT LLC, the domain resolves to IP address 163.61.188.2, hosted on AS153568 (NEW DHAKA HARDWARE) in the United States. The site presents itself under the page title 'Web3ledger — The Future of Digital Finance,' which aligns with the stated scam type of brand impersonation targeting Ledger users. Infrastructure analysis reveals the use of Let's Encrypt SSL certificate R13, a common choice for both legitimate and malicious sites. The domain employs four nameservers under lytehosting.com (dns1.lytehosting.com through dns4.lytehosting.com), a provider frequently associated with low-cost or bulletproof hosting. Detected technologies include LiteSpeed web server, Smartsupp (a live chat tool), GetButton (a floating action button service), and HTTP/3 protocol support, alongside embedded YouTube content, which may be used to enhance credibility. Threat intelligence platforms have flagged this domain in multiple pulses, with AlienVault OTX listing it in four distinct reports. It is currently blocked by at least one security vendor (PhishDestroy) and appears on a single security blocklist. Gridinsoft assigns it a trust score of 1 out of 100, indicating high risk. While VirusTotal data shows 10 out of 91 security vendors detecting the domain as malicious, this does not constitute exhaustive validation, as detection rates can vary based on vendor coverage and update cycles. The domain remains active as of July 12, 2026, returning an HTTP 200 status code, suggesting ongoing operational use. Defenders should treat this domain as high-risk infrastructure and prioritize blocking or monitoring it in environments where Ledger-related services are accessed.