ledgernanorange[.]com

The domain ledgernanorange.com is currently active and has been classified as a high‑risk brand‑impersonation site targeting the Ledger brand. Analysis flags the domain as a cryptocurrency‑related scam, and the threat level is rated high by the assessment framework.

Infrastructure analysis shows the domain was registered on August 11, 2025 through Sav.com, LLC. It uses the public name servers ns1.hostname.net and ns2.hostname.net and resolves to the IP address 76.76.21.142, which belongs to AS16509 operated by Amazon.com, Inc. The IP is geolocated to the United States. No TLS certificate is present, and the HTTP response returns status code 200. The page title returned by the server is “추천 프로그램 | Ledger”. The domain appears on one external security blocklist and is listed as blocked by PhishDestroy. VirusTotal reports a single detection out of 95 scanned vendors.

The available intelligence indicates that the site is designed to impersonate Ledger and to lure victims into cryptocurrency‑related fraud, although the specific content and lure mechanisms have not been captured in this assessment. The Korean‑language page title suggests a possible regional targeting, but the absence of a secure certificate and the use of generic hosting raise the likelihood of a short‑lived malicious infrastructure. No additional indicators such as malware hashes, phishing kits, or compromised credentials have been observed.

Defenders should add ledgernanorange.com to blocklists at network and endpoint layers, and enforce strict TLS inspection to prevent any clear‑text communication. Monitoring for outbound connections to 76.76.21.142 and for DNS queries for the domain is recommended. Users should be warned that any unsolicited communication referencing Ledger and requesting cryptocurrency transactions is likely fraudulent. Continuous re‑evaluation is advised, as the site may evolve or be replaced with new infrastructure.