fx-ledger-transaction-check[.]com

Analysis of fx-ledger-transaction-check.com shows a newly registered domain (created 18 September 2025) that has been used to impersonate the Ledger brand in a crypto‑related scam. The domain resolves to the IP address 80.66.87.123, which is allocated to International Hosting Company Limited (AS216127) in Germany. No TLS certificate is presented, indicating the site was served over plain HTTP. The page title returned by the server is identical to the domain name, offering no additional context. Registration details list Web Commerce Communications Limited as the registrar, and the authoritative nameservers are a.dnspod.com, b.dnspod.com, and c.dnspod.com, a pattern commonly observed in fast‑flux or disposable hosting services.

Threat intelligence feeds have flagged the domain. PhishDestroy has already blocked it, and it appears on one public blocklist. VirusTotal scans report that 19 of 93 security vendors label the domain as malicious, reinforcing the suspicion of nefarious activity. AlienVault OTX records the domain in a single threat‑intel pulse, further corroborating its association with malicious campaigns. The listed scam type is “Crypto Scam,” indicating that the operator likely attempts to lure victims into disclosing private keys, seed phrases, or to send cryptocurrency to fraudulent addresses.

As of the assessment date (24 July 2026) the host is offline, but the infrastructure components remain active and could be reused for future campaigns. Uncertainty remains regarding the exact landing page content, as no visual analysis is available, and the lack of SSL prevents verification of any credential‑capture forms. Defenders should add the domain and its resolving IP to deny lists, monitor DNS queries for the listed dnspod nameservers, and apply generic Ledger brand protection rules in email and web gateway filters. Continuous observation of the AS216127 address block is advised, as it may host additional Ledger‑impersonating sites.