ledger[.]yoga

Analysis indicates that ledger.yoga is an active brand‑impersonation site targeting users of the Ledger hardware‑wallet ecosystem. The domain was registered on 24 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP 82.29.86.175, which is hosted in the United States by Hostinger. The web server runs LiteSpeed with HTTP/3 support and presents a Let’s Encrypt certificate (YE2). DNS is delegated to aurora.dns‑parking.com and nebula.dns‑parking.com, typical of parking services used for malicious infrastructure. The page title returned by the server is “Ledger Wallet Crypto App — Independent Affiliate Review”, confirming the intended brand impersonation. VirusTotal reports that 15 of 91 security vendors flag the domain, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on one external blocklist and has been listed by PhishDestroy, while AlienVault OTX references it in a single pulse. Evidence does not include the actual page content, the specific credential‑capture mechanism, or any associated malware payload, leaving the exact attack vector uncertain. Defenders should treat the domain as high‑risk: block DNS resolution to ledger.yoga and the associated IP address, add the domain to web‑filter deny lists, and monitor for outbound connections to the host. Email security gateways should be updated to flag any messages referencing ledger.yoga or using Ledger branding. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure.