ledgercryptoservice[.]com

ledgercryptoservice.com was registered on March 22, 2026 through Dynadot Inc. The domain resolves to IP 147.93.99.165, which is geolocated to India and hosted by Hostinger International Ltd. VirusTotal analysis shows that 6 of 95 scanned security vendors flag the domain as malicious. The site currently returns HTTP 200 and is listed on a single security blocklist, indicating active exploitation.

The server presents a valid Let’s Encrypt certificate (R12) and supports HTTP/3, suggesting a modern web stack. Nameserver records point to aster.dns-parking.com and helios.dns-parking.com, both typical of parked or low‑cost hosting services. Detected technologies include Bootstrap, LiteSpeed, jsDelivr, and Hostinger, confirming the use of generic web‑hosting components rather than a bespoke infrastructure.

The page title “CypherGuard | Secure Wallet Recovery Suite” and the presence of a known Recovery Scam phishing kit indicate a targeted seed‑phrase theft campaign against Ledger wallet users. The site explicitly impersonates Ledger, attempting to lure victims into submitting their cryptocurrency recovery seed phrases. Gridinsoft assigns a trust score of 1 out of 100, and the domain is currently blocked by PhishDestroy, reinforcing its malicious intent.

Open questions remain regarding the full scope of compromised accounts and any additional command‑and‑control infrastructure that may be leveraged behind the same IP address. Defenders should block the domain and its associated IP at perimeter defenses, monitor DNS queries for the asterisk and helios nameservers, and enforce user education on verifying legitimate Ledger communications. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure.