mysecure-ledger[.]com

On 23 July 2026, analysts recorded the domain mysecure-ledger.com as an active brand‑impersonation campaign targeting Ledger. The domain was registered through Dominet (HK) Limited on 5 November 2025 and uses the DNS provider dnspod with three authoritative name servers (a.dnspod.com, b.dnspod.com, c.dnspod.com). Resolution points to IP address 80.66.87.123, which is allocated to AS216127 International Hosting Company Limited in Germany. No TLS certificate is present, indicating the site operated without HTTPS. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one public security blocklist.

PhishDestroy has also listed the domain as malicious. VirusTotal analysis shows that 14 of 93 scanned security vendors flagged the domain, reinforcing the malicious classification. The campaign is categorized as a crypto‑scam, and the brand target is explicitly Ledger, suggesting the attacker likely attempted to harvest cryptocurrency‑related credentials or payments. The site is currently offline, which may be the result of takedown actions or temporary suspension.

Uncertainties remain regarding the specific payload or landing page content, as no page title or HTTP response details are available. Defenders should block the host IP 80.66.87.123 and the domain mysecure-ledger.com at DNS and firewall layers, add the domain to internal threat intel feeds, and monitor for any future re‑registration attempts. Continuous observation of the registrar Dominet and the dnspod name‑server set is recommended to detect fast‑flux or copycat domains that may reuse similar naming patterns. Correlation with other Ledger‑related phishing indicators can help prioritize remediation efforts.