ledger-io[.]net

PhishDestroy first observed ledger-io.net on Sep 8, 2026. The hostname explicitly references Ledger; stored content metadata identifies the same apparent target. Current evidence score: 68/100 (high).

Positive findings are stored from 3 sources: VirusTotal, MetaMask, and SEAL. VirusTotal recorded 6 detections among 89 engines: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar on Sep 8, 2026 at 20:54 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Sep 8, 2026 at 14:20 UTC. Non-positive and contextual checks: AlienVault OTX listed 4 community pulse references (not vendor detections) on Sep 8, 2026 at 20:56 UTC. Google Safe Browsing returned no flag on Sep 8, 2026 at 20:54 UTC. A URLScan capture is available, but no capture timestamp was recorded.

An access-restricted HTTP 403 response was recorded. Registration records for the domain list Hosting Concepts B.V. d/b/a Registrar.eu as the registrar and Aug 28, 2026 as the creation date. Registration preceded first observation by 11 days. The evidence archive retains 1 visual capture from PhishDestroy; no page title was retained, so the captures preserve the landing-page appearance.

The content indicators and 3 positive source findings support the current Ledger impersonation and phishing classification. The target field identifies Ledger, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.