ledger[.]gd

Analysis of the domain ledger.gd indicates a high‑risk brand‑impersonation campaign targeting Ledger users. The domain was registered on November 06, 2025 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 186.2.171.37, which is allocated to the Russian autonomous system AS59692 (IQWeb FZ-LLC). No SSL certificate is present, meaning the site does not support HTTPS and would be accessed via plain HTTP. The authoritative nameservers are ns1.ddos-guard.net and ns2.ddos-guard.net, a pair commonly used by malicious operators to provide rapid DNS changes and DDoS protection.

The page title returned by the server is "Ledger Live App – Download & Setup Desktop & Mobile App", directly referencing Ledger's official software suite. This suggests the site attempts to lure victims into downloading a counterfeit Ledger Live client or submitting credentials. The campaign is classified as a crypto scam, consistent with the impersonated brand and the financial motivation of harvesting private keys or installing malware.

Detection metrics show that 15 of 95 security vendors on VirusTotal flag ledger.gd as malicious, reinforcing the suspicion of malicious behavior. The domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among threat‑intelligence feeds that the site is used for phishing or fraud. Current operational status is offline, but the infrastructure indicators remain active and may be reused for future campaigns.

Defenders should add ledger.gd to deny‑list rules in firewalls, proxy filters, and endpoint protection suites. Because the domain uses generic DNS services, monitoring for additional subdomains or similarly structured domains under the same registrar or IP range is advisable.