safe[.]ledgerweb3chain[.]com

Analysis of safe.ledgerweb3chain.com shows a newly registered domain created on February 21, 2026 that is currently offline but was previously identified as a crypto‑related impersonation campaign targeting the 1inch brand. The domain resolves to IP address 173.249.4.28, which is hosted in France under ASN 51167 operated by Contabo GmbH. Nameserver records point to ns7.skycorehost.com and ns8.skycorehost.com, confirming the hosting provider. Registration was performed through Global Domain Group LLC, a registrar that has been associated with other malicious registrations.

No TLS certificate is present, meaning the site was served over plain HTTP, a common characteristic of low‑cost phishing infrastructure. The page title reported by crawlers reads “Ledger Web3 Chain – Connecting Decentralised Applications,” suggesting an attempt to associate the site with legitimate blockchain services. VirusTotal scans flagged the domain in 14 of 93 security engines, indicating moderate detection across the ecosystem. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist.

PhishDestroy has already taken the domain offline, reducing immediate exposure. Uncertainty remains regarding the full scope of the campaign, including whether additional domains or infrastructure components were used, and whether any victim interaction occurred before takedown. Defenders should update URL filtering and DNS blocklists to include safe.ledgerweb3chain.com, monitor for any related sub‑domains or future registrations that reuse the same registrar or hosting provider, and enforce strict TLS validation to prevent connections to non‑encrypted sites. Continuous threat‑intel feeds should be consulted for any resurgence of the 1inch impersonation pattern.