web-ledgr[.]teachable[.]com

Analysis of web-ledgr.teachable.com shows infrastructure commonly used in credential‑stealing operations targeting cryptocurrency users. The domain was registered on February 21, 2026 through Amazon Registrar, Inc. and resolves to IP address 34.54.192.65, which belongs to AS396982 (Google LLC) in the United States. DNS is served by Cloudflare’s ian.ns.cloudflare.com and nina.ns.cloudflare.com, and the site presents a Google Trust Services / WR3 SSL certificate, indicating use of Google‑issued TLS. HTTP response returns a 404 status with the page title "404 Error - Teachable," suggesting the host content is presently unavailable.

Technical fingerprints reveal deployment of Google Cloud services, Google Cloud CDN, HSTS, HTTP/3, and the Mailgun email platform, a stack frequently observed in malicious phishing kits. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed, confirming that threat‑intel communities have identified it as malicious. VirusTotal records indicate the domain was scanned by 93 vendors without any detections, but the absence of alerts does not constitute a safety assurance. The primary threat vector is a crypto‑scam impersonating Ledger, as indicated by the "Impersonates: Ledger" tag.

Current status is offline, yet the infrastructure remains observable and could be re‑activated. Defenders should continue to monitor the IP address 34.54.192.65 for any future activity, enforce domain‑based blocklists in web filtering solutions, and instruct users to verify Ledger communications through official channels. Additional scrutiny of related subdomains and any Mailgun‑generated email traffic is advised to pre‑empt potential credential‑harvesting campaigns.