upriskledger[.]com

Analysis of upriskledger.com shows a high‑risk brand impersonation campaign targeting Ledger users. The domain was registered on February 21, 2026 through GoDaddy.com, LLC and resolves to the Amazon Web Services IP address 15.197.225.128 (AS16509). The site responds with an HTTP 301 redirect and serves a SSL certificate issued by Go Daddy Secure Certificate Authority - G2, confirming active TLS use. Page metadata reveals the title "Third Party Risk Management Solutions | Risk Ledger," which does not reference Ledger, indicating the site may be attempting to masquerade as a legitimate risk‑management service while leveraging the Ledger brand for credibility.

Infrastructure scans show the presence of Apple iCloud Mail, Reddit Ads, LinkedIn Ads, jsDelivr, HubSpot, Hotjar, and HSTS enforcement, suggesting a mixed marketing and analytics stack typical of phishing infrastructure. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist (PhishDestroy), confirming that threat intelligence providers have flagged it as malicious. VirusTotal reports detections from two of ninety‑three scanners, providing additional independent confirmation of compromise. The domain is currently listed as active and is classified as a crypto scam, reinforcing the likelihood of attempts to solicit cryptocurrency or credential information from Ledger customers.

Defenders should block the domain and its associated IP at perimeter firewalls, add the nameservers ns55.domaincontrol.com and ns56.domaincontrol.com to DNS sinkhole lists, and monitor for outbound connections to the AWS host. Email security gateways should enforce strict sender verification for any messages claiming to originate from Ledger, and users should be educated to disregard unsolicited communications referencing risk‑management services that use the Ledger name. Continuous monitoring of threat feeds for additional detections related to this domain is recommended.