ledger-protection-system[.]com

The domain ledger-protection-system.com was registered on March 06, 2026 through Dreamscape Networks International Pte Ltd and resolves to IP 138.201.20.5, which belongs to Hetzner Online GmbH (AS24940) in Germany. The authoritative nameservers are angela.ns.cloudflare.com and greg.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The site presents a TLS certificate issued by Let’s Encrypt (R13) and returns an HTTP 200 response, yet the page title reported is “403 Forbidden,” suggesting that the front‑end may be intentionally inaccessible or that access is restricted to certain request patterns. The domain is classified as a brand‑impersonation campaign targeting Ledger and is listed as a crypto‑related scam. It appears on three security blocklists and has been blocked by multiple threat‑mitigation services, including PhishDestroy, MetaMask, and SEAL. Reputation scoring from Gridinsoft assigns a 0/100 trust rating, and two of 94 VirusTotal scanners have flagged the domain, reinforcing the malicious assessment. While the exact payload or credential‑harvesting mechanisms have not been observed, the combination of recent creation, low trust score, active blocklist entries, and targeted brand impersonation indicates a high‑risk profile. Defenders should add the domain and its resolving IP to blocklists, monitor DNS queries for the associated Cloudflare nameservers, and consider sinkholing traffic to prevent potential victim interaction. Continuous re‑evaluation is advised should additional indicators, such as malicious payloads or phishing pages, become available.