getledger[.]kb[.]help

The domain getledger.kb.help was registered on January 05, 2018 through Marcaria International LLC and is hosted on Amazon Web Services (AS16509) in Germany, resolving to IP address 3.170.51.39. The DNS configuration lists four Amazon‑provided nameservers (ns-1181.awsdns-19.org, ns-1362.awsdns-42.org, ns-1794.awsdns-32.co.uk, ns-1883.awsd). An Amazon RSA 2048 M01 certificate secures the site, indicating the use of standard AWS TLS services. HTTP probing returns a 404 status, and the page title observed is "Getting™ Started | Ledger.com/start®®", directly referencing the Ledger brand, confirming a brand‑impersonation campaign.

The domain appears on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows four of ninety‑one security vendors flagging the domain, reinforcing its malicious reputation. Current infrastructure status is offline, with the site taken down.

Defenders should continue to block the domain at perimeter and DNS layers, add the associated IP 3.170.51.39 to network‑level deny lists, and monitor for new sub‑domains or similar patterns using the same AWS nameserver set. Updating intrusion detection signatures to flag the exact page title and registrar information will improve early detection. Continuous watch of the Amazon S3 and CloudFront services tied to this ASN is advised, as the actors may redeploy the payload on new resources while retaining the same registration and hosting profile.