2935923-ledger[.]com

Analysis of the domain 2935923-ledger.com indicates it was registered on February 21, 2026, through Hello Internet Corp, targeting Ledger, a recognized cryptocurrency hardware wallet provider. The domain is currently offline, resolving to the loopback IP 127.0.0.1, which suggests it may have been sinkholed or taken down. Infrastructure analysis reveals Cloudflare nameservers (colin.ns.cloudflare.com and meg.ns.cloudflare.com), a common tactic to obscure hosting details and evade detection. The SSL certificate is issued by PhishDestroy, linked to the issuer botadmin.destroy.tools, further supporting its classification as malicious infrastructure.

Detection data shows the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 4 of 93 security vendors on VirusTotal. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status. The scam type is explicitly categorized as a crypto scam, aligning with the impersonation of Ledger. MX records point to localhost (priority 0), a configuration often used in phishing setups to avoid email-based detection or to stage credential-harvesting campaigns.

While the domain is no longer active, defenders should treat it as a confirmed threat. Historical DNS and WHOIS records should be preserved for forensic analysis, and any residual references in logs or proxy data should be investigated for potential compromise. The use of Cloudflare nameservers and a sinkholed IP suggests prior malicious activity, and similar domains registered through Hello Internet Corp should be monitored for emerging threats. No evidence of a phishing kit or additional page content is available, limiting further classification beyond the crypto scam designation.