ledger[.]great-site[.]net

The domain ledger.great-site.net has been identified as a high‑risk brand‑impersonation site targeting Ledger customers. Analysis confirms that the page title explicitly references Ledger hardware wallets, indicating a deliberate attempt to mislead users seeking legitimate Ledger information. The threat is classified as seed_phish, reflecting its focus on harvesting cryptocurrency seed phrases.

Infrastructure investigation shows the domain was registered on August 13, 2020 through NameCheap, Inc. It is hosted on a server located in Great Britain, operating under AS34119 Wildcard UK Limited, and resolves to the IPv4 address 185.27.134.153. The authoritative nameservers are ns1.infinityfree.com and ns2.infinityfree.com, both associated with free‑hosting services. The site serves content over HTTPS using a ZeroSSL ECC Domain Secure Site CA certificate, and responds with HTTP status code 200, indicating normal web service operation.

Detection metrics reinforce the malicious profile: Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 2 out of 95 scanned security vendors flag the domain as malicious. The site appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole network. Current status remains active, and the unique seed identifier 0bb163 links this observation to broader threat‑intel collections.

Defenders should prioritize blocking ledger.great-site.net at perimeter and DNS layers, monitor outbound traffic for attempts to resolve the associated IP address, and enforce multi‑factor authentication for any Ledger‑related services to mitigate credential harvesting. Continuous threat‑intel feeds should be consulted for any emergence of additional indicators of compromise related to the underlying hosting provider or associated certificate authority, and incident response teams should treat any user reports involving Ledger seed phrases as potentially compromised due to this active campaign.