ledgerguard[.]dingnut[.]com

The domain ledgerguard.dingnut.com was registered on April 27, 2026 and is currently active. Analysis classifies it as a credential phishing campaign that impersonates the Ledger brand, as indicated by the page title "Sign In | LedgerGuard" and the explicit branding target. The risk level is marked under_investigation, reflecting ongoing monitoring.

Infrastructure analysis shows the domain resolves to IP address 216.150.1.193, which is associated with Vercel, Inc. in the United States. Registration is handled through Cloudflare, Inc., and the authoritative name servers are diva.ns.cloudflare.com and luke.ns.cloudflare.com. The site serves an HTTPS endpoint secured by a Let's Encrypt certificate (R13) and returns an HTTP 307 redirect, suggesting intentional traffic handling.

Threat intelligence indicates the domain appears on a single security blocklist and has been blocked by PhishDestroy. The page title explicitly references LedgerGuard, confirming the intent to lure Ledger users for credential harvesting. No detections were reported on VirusTotal (0/95) and Gridinsoft assigns a trust score of 0/100, but these metrics alone do not confirm safety or maliciousness.

Uncertainties remain regarding the exact content hosted at the URL, as no visual or structural analysis is available. The lack of VirusTotal detections may reflect limited exposure rather than benign behavior. Continued observation is required to assess any evolution in the site’s payload or distribution tactics.

Defenders should add ledgerguard.dingnut.com to domain blocklists, monitor DNS queries for the associated IP, and enforce strict credential verification controls for Ledger services. Ongoing threat intel feeds should be consulted for any new detections, and any traffic redirected to the domain should be logged for forensic review.