lebger[.]net

This domain lebger.net was registered on 21 February 2026 through Web Commerce Communications Limited and is presently taken offline. The authoritative name servers are keaton.ns.cloudflare.com and tiffany.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. No TLS certificate is presented for the host, meaning HTTPS connections are not available and any attempt to load the site would result in an unsecured HTTP response or a connection failure. The page title returned by the server is "www.www.lebger.net", a repetitive pattern that does not reference the targeted brand.

The site is classified as a wallet/seed phishing campaign that impersonates the Ledger brand, specifically aiming to harvest cryptocurrency wallet seeds. VirusTotal scans show that two of ninety‑five security vendors flagged the domain as malicious, and the domain appears on one external blocklist. PhishDestroy has also listed the domain as blocked, providing additional confirmation of its malicious intent. Evidence from the registration record, DNS configuration, and the lack of SSL collectively suggest an opportunistic infrastructure set up to host a fraudulent landing page.

The offline status prevents current content analysis, so the exact visual or credential‑capture mechanisms remain unknown. Defenders should continue to block the domain at network perimeter devices, add the associated IP address to deny‑list rules, and monitor for any resurgence of activity. Threat intelligence sharing platforms should be updated with the registration details, name‑server information, and the observed flagging by VirusTotal and PhishDestroy. Analysts should also watch for similar patterns—repetitive subdomain naming, use of Cloudflare DNS, and absence of TLS—to identify future Ledger impersonation attempts.