ledgerl[.]net

ledgerl.net is currently classified as a high‑risk brand‑impersonation site targeting Ledger. The domain was registered on 17 May 2026 through West263 International Limited and remains active as of 12 July 2026. Automated analysis flags the site as a Ledger impersonation and it is listed on the PhishDestroy blocklist.

Infrastructure analysis shows the domain resolves to 162.209.140.178, an address hosted in Hong Kong and assigned to AS40065 CNSERVERS LLC. The authoritative name servers are ns1.363.hk, ns2.363.hk, ns1.myhostadmin.net, and ns2.myhostadmin.net, a configuration commonly observed in malicious hosting clusters. The site presents a valid Let’s Encrypt YR1 certificate, which does not mitigate the underlying threat. Gridinsoft assigns a trust score of 0 / 100, indicating a lack of reputational confidence.

Web content returns HTTP 200 and advertises a Chinese‑language page titled “中文版ledger钱包下载网址|ledger钱包app下载|ledger钱包app官网|全球信赖的硬件钱包品牌 - tp官方最新下载”, explicitly referencing Ledger’s product terminology. VirusTotal reports that 10 of 95 scanned security vendors flag the domain, providing modest but consistent detection across multiple engines. The domain appears on one external security blocklist, reinforcing the perception of malicious intent.

Defenders should block resolution to 162.209.140.178 at network perimeter and add ledgerl.net to URL filtering rules. Email security gateways must treat any message containing this domain as malicious and quarantine associated attachments. Continuous monitoring of the associated name servers and certificate renewal cycles is advised, as changes may indicate campaign evolution. Users should be warned that any request to download Ledger software from this domain is fraudulent.