ledger-fr[.]gxtigroup[.]com

Analysis of ledger-fr.gxtigroup.com indicates a brand impersonation domain targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered on January 31, 2020, through PDR Ltd. d/b/a PublicDomainRegistry.com, currently resolves to IP 176.9.208.67, hosted on AS24940 (Hetzner Online GmbH, Germany). As of July 23, 2026, the domain is offline, returning a 404 Not Found HTTP status, and no SSL certificate is present. Infrastructure analysis reveals nameservers ns1.gigalayer.com, ns2.gigalayer.com, and ns3.gigalayer.com, a pattern consistent with other phishing domains leveraging the same provider.

Detection data shows the domain appears on one security blocklist (PhishDestroy) and is flagged by 14 of 95 security vendors on VirusTotal, confirming its classification as a crypto scam. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious designation. The domain's creation date predates the current detection activity, suggesting it may have been dormant or repurposed for this campaign. Defenders should treat this domain as confirmed malicious infrastructure.

Recommended actions include blocking the domain and its resolving IP at perimeter security controls, monitoring for related subdomains under gxtigroup.com, and alerting users to the Ledger brand impersonation risk. While the domain is offline, historical DNS records and hosting patterns should be reviewed for potential reuse or migration to new infrastructure. No evidence of a phishing kit or specific lure content is available for further classification.