us-user-ledger[.]com

Analysis of the domain us-user-ledger.com confirms its classification as a crypto scam impersonating Ledger, a hardware wallet provider. The domain was registered on November 5, 2025, through Dominet (HK) Limited and resolved to the IP address 80.66.87.123, hosted under AS216127 (INTERNATIONAL HOSTING COMPANY LIMITED) in Germany. As of July 23, 2026, the domain is offline, though it remains listed on one security blocklist (PhishDestroy) and was flagged by 7 of 93 security vendors on VirusTotal prior to its takedown.

No SSL certificate was detected, and the nameservers (a.dnspod.com, b.dnspod.com, c.dnspod.com) suggest a pattern consistent with malicious infrastructure. The domain's Gridinsoft trust score of 0/100 further supports its malicious classification. While the exact content of the site was not analyzed, the available evidence—including the domain naming convention, scam type classification (crypto scam), and brand target (Ledger)—indicates it was designed to deceive users into disclosing sensitive information or transferring cryptocurrency.

Defenders should treat this domain as confirmed malicious and block it at the DNS and network levels. Historical logs should be reviewed for connections to 80.66.87.123 or the domain itself, particularly within the active window of November 2025 to July 2026. No additional phishing kit or page title details are available at this time.