ledger[.]ftp[.]sh

This domain, ledger.ftp.sh, is under investigation for brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the domain was registered through Dynadot LLC and resolves to the IP address 185.177.59.244. The page title explicitly displays 'Ledger,' aligning with the impersonation claim. The domain holds a Gridinsoft trust score of 0/100 and appears on one security blocklist, specifically PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The domain was created on May 29, 2000, which predates Ledger's founding; this may suggest domain repurposing or an unrelated historical registration. No vendor detections are currently reported on VirusTotal, though this absence does not confirm safety. The domain remains active as of July 12, 2026, and no additional infrastructure or hosting details (e.g., ASN, geolocation) are available for further assessment. Defenders should treat this domain as high-risk due to its explicit brand impersonation, low trust score, and presence on a security blocklist. Immediate action includes blocking the domain and associated IP at the perimeter, monitoring for internal connections, and reviewing logs for any prior interactions. If Ledger-related assets or users are present in the environment, heightened scrutiny of cryptocurrency-related communications is recommended. Further analysis of the site's content and behavior is required to determine the exact nature of the threat, such as credential harvesting or malware distribution.