ledger[.]xiazaiai[.]com

ledger.xiazaiai.com was registered on June 23 2025 through GoDaddy.com, LLC and uses the default domaincontrol.com name servers (ns01.domaincontrol.com, ns02.domaincontrol.com). The site resolves to IP 156.234.51.105, which is advertised as being located in Hong Kong and belongs to AS138415 Yancy Limited. The domain appears on one security blocklist and is flagged by PhishDestroy as active.

The web server returns HTTP 200 and presents a valid Let’s Encrypt certificate (YR1). Content analysis shows a WordPress installation backed by MySQL and PHP, with Yoast SEO plugins active. The page title displayed is “Ledger Live 管理 加密货币钱包应用程序 | Ledger”, a direct copy of the official Ledger branding, indicating deliberate impersonation of the Ledger product line.

Threat intelligence scores reinforce the malicious posture: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 2 of 95 scanned security vendors flag the domain, confirming the presence of suspicious elements. The site’s primary purpose appears to be brand impersonation, as it mimics Ledger’s official language and visual cues without providing any legitimate service.

Defenders should immediately block both the domain and its resolving IP address at perimeter firewalls and DNS filters. Continuous monitoring of the associated name servers for any changes is advised, as the registrar’s default settings can be altered to facilitate future campaigns. Traffic inspection should include TLS fingerprinting of the Let’s Encrypt certificate to detect hijacked connections, and security teams should share this indicator set with upstream threat feeds.