ledger-official[.]icu

Analysis of ledger-official.icu indicates that the domain was registered on February 21, 2026 and currently resolves to the IP address 188.114.96.3. The IP is hosted within the United States and is associated with AS13335, operated by Cloudflare, Inc. The site is marked as a crypto‑related scam and explicitly impersonates the Ledger brand, as reflected in the supplied brand target. The single observed page title reads "Nur einen Moment…", which provides no direct indication of the malicious payload but confirms that the domain is serving content rather than returning a generic error. VirusTotal scans show that four of ninety‑three security vendors flagged the domain, suggesting a modest detection rate that aligns with the limited public exposure of the site.

The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy service, further corroborating its malicious intent. An SSL certificate labeled WE1 was presented during connection attempts, but no additional certificate transparency details are available. Gridinsoft’s trust scoring system assigns a zero‑out‑of‑hundred rating, indicating a lack of trustworthiness. As of the report date, July 24, 2026, the infrastructure is reported to be taken offline, which may be a temporary takedown or an operational pause.

Defenders should continue to monitor the IP address 188.114.96.3 for any re‑activation, enforce blocklisting of the domain in web filtering solutions, and consider adding the associated IP to network‑level deny lists. Organizations that use Ledger products should educate users about unsolicited communications that reference Ledger and advise verification of URLs before any credential entry. Ongoing vigilance is recommended, as threat actors may repurpose the same hosting infrastructure for future campaigns.