ledger[.]com[.]ag

This domain, ledger.com.ag, was registered on March 18, 2026 through Hosting Concepts B.V. operating as Registrar.eu and is currently hosted on an IP address owned by Omegatech LTD in the Netherlands (158.94.209.135). The authoritative name servers are ns1.openprovider.nl, ns2.openprovider.be, and ns3.openprovider.eu, all belonging to Openprovider. The web server presents an Nginx stack secured with a Let’s Encrypt R13 certificate, yet HTTP requests receive a 403 response, indicating that the site is deliberately inaccessible. The page title returned by the server is “Welcome”, but no further content has been captured, and the domain is listed as offline in current monitoring tools.

Reputation checks show a Gridinsoft trust score of zero out of one hundred, reflecting extreme suspicion. VirusTotal analysis recorded 16 detections out of 94 scanning engines, and the domain is actively blocked by PhishDestroy, MetaMask, and SEAL. It also appears on three additional security blocklists. The primary threat classification is a crypto‑related scam that impersonates the Ledger brand, consistent with the known “Crypto Scam” tag.

Given the combination of a recent registration date, low‑trust scoring, multiple vendor detections, and active blocklist inclusion, the infrastructure is highly indicative of a brand‑impersonation campaign targeting Ledger users. Defenders should continue to block the IP address 158.94.209.135 at network perimeter devices, add ledger.com.ag to URL filtering and email security policies, and monitor for any future re‑activation. Continuous observation of the registrar and name‑server records is advised, as changes could signal a shift to an active phishing site. Until the domain reappears online, the present evidence supports maintaining a high‑risk posture.