web3ledgerbackup[.]org

The domain web3ledgerbackup.org is currently active and has been classified as a high‑risk brand‑impersonation site targeting Ledger. The site presents a page titled “Home – Web3 Vell – A crypto buy and sell marketplace,” a clear attempt to lure cryptocurrency users under the guise of a Ledger‑related service. Technical investigation shows that the domain resolves to the IPv4 address 213.130.145.244, which belongs to AS47583 hosted by Hostinger International Limited in France. The domain is secured with a Let’s Encrypt certificate (YR2) and returns an HTTP 301 redirect, indicating a deliberate redirection strategy. Registration occurred on October 13, 2025 through TuringSign Inc. d/b/a Cosmotown, and the authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com, both typical of parked or disposable domains. Virustotal reports that 6 of 95 security vendors flag the domain, indicating partial detection across the industry. The site appears on a single security blocklist (PhishDestroy) and receives a Gridinsoft trust score of 17 out of 100, reinforcing its malicious reputation. MX records are configured to mx1.titan.email (priority 10) and mx2.titan.email (priority 20), which are unrelated to Ledger’s official mail infrastructure, further confirming the fraudulent nature of the domain. Defenders should block web3ledgerbackup.org at the DNS and firewall layers, and also consider denying traffic to its hosting IP 213.130.145.244. Continuous monitoring of any newly resolved IPs from the same registrar and nameserver set is advised, as the operators may shift infrastructure. Additionally, threat‑intelligence feeds should be updated to include the domain and its associated IP to improve detection across endpoint and email security solutions. Users should be warned that any unsolicited communications referencing Ledger that originate from this domain are unauthenticated and likely malicious.