ledgerfactory[.]honestme[.]cyou

The domain ledgerfactory.honestme.cyou was registered on July 21, 2025 and is currently active. It is classified under brand_impersonation targeting the Ledger brand, with a risk level marked as under_investigation. The page title returned from the server is “Embracing My Journey”, which does not directly reference the target brand but is part of the observed content. Network analysis shows the domain resolves to the IP address 172.67.199.238, hosted within the United States under ASN 13335 operated by Cloudflare, Inc. DNS resolution uses the Cloudflare authoritative name servers dana.ns.cloudflare.com and hasslo.ns.cloudflare.com. An HTTPS connection is presented with a certificate issued by Google Trust Services, bearing the WE1 designation. The web server reports an HTTP 302 status code, indicating a redirection, and fingerprints the stack as Nginx with client‑side jQuery libraries. Security scoring indicates a Gridinsoft trust score of 0 out of 100, suggesting extremely low confidence in legitimacy. The domain appears on a single security blocklist, specifically PhishDestroy, confirming prior detection by external monitoring. The reported scam type is cryptocurrency, aligning with the Ledger brand’s involvement in hardware wallets and digital asset management. While VirusTotal currently records 0 detections out of 95 engines, this absence of flags does not constitute assurance of safety. Analysts should treat ledgerfactory.honestme.cyou as a malicious infrastructure element. Defensive teams are advised to block the domain and associated IP address at network perimeters, enforce DNS sinkholing for the identified name servers, and monitor for any outbound connections to the Cloudflare edge. Continuous re‑assessment is recommended, given the active status and the under_investigation risk rating. Further investigation of the redirection target and any payload delivered after the 302 response will help clarify the full attack chain.