ledger[.]com[.]ua

Analysis of ledger.com.ua indicates a high‑risk brand impersonation campaign targeting users of Ledger hardware wallets. The site registers a 301 redirect and presents the page title “Ledger Crypto Wallet – Security for DeFi & Web3”, directly referencing the Ledger brand and suggesting a cryptocurrency wallet service. VirusTotal scans have flagged the domain in 7 of 93 security engines, demonstrating partial detection across the ecosystem. Gridinsoft assigns a trust score of 0 / 100, and AlienVault OTX lists the domain in a single threat pulse, confirming its presence in open‑source intelligence feeds. The domain appears on at least one public blocklist and is explicitly blocked by PhishDestroy, reinforcing its malicious reputation.

Infrastructure details show registration through Gransy s.r.o. on 7 March 2019, with authoritative nameservers hosted by Gandi (ns‑148‑b.gandi.net, ns‑171‑a.gandi.net, ns‑74‑c.gandi.net). The site resolves to 104.18.34.152, an address owned by Cloudflare (AS13335) located in the United States, and presents a TLS certificate issued by GandiCert, indicating a legitimate‑looking SSL chain that may deceive casual users. Technology fingerprints reveal a WordPress stack supplemented by Contentful, MySQL, PHP, Amazon Web Services, Yoast SEO, Swiper and Optimizely, a combination often leveraged by opportunistic phishing sites to host dynamic content and analytics. While the page title and brand references confirm a Ledger impersonation, no publicly available samples of the page’s HTML, login forms, or payloads have been disclosed, leaving the exact method of credential or private‑key harvesting uncertain.

Defenders should therefore treat any traffic to ledger.com.ua as malicious. Recommended actions include adding the domain to DNS‑based deny lists, enforcing block rules in web proxies, and monitoring Cloudflare‑owned IP ranges for anomalous connections.