ledgerclaim[.]xyz

Analysis of ledgerclaim.xyz, observed as a brand‑impersonation campaign targeting Ledger, indicates a crypto‑related scam. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to 172.67.165.138, an IP owned by Cloudflare (AS13335, United States). The site employed Cloudflare services, including Browser Insights and HTTP/3, and presented the page title “Just a moment…”, which is the default Cloudflare challenge page rather than a malicious landing page. The SSL certificate is issued by Google Trust Services under the WE1 designation, consistent with Cloudflare‑proxied sites.

Threat intelligence shows the domain is listed on two security blocklists (PhishDestroy, ScamSniffer) and six of ninety‑five VirusTotal scanners flagged it, confirming malicious intent. The campaign explicitly impersonates the Ledger brand and is classified as a crypto scam. The current status is offline, but the underlying Cloudflare edge infrastructure can be re‑activated quickly, so the risk remains elevated. No detailed payload or phishing page content has been captured; the exact lure used to deceive victims is not visible, and the page title provides no insight into user‑facing content.

Defenders should block ledgerclaim.xyz at DNS and proxy layers, add the associated IP 172.67.165.138 to network‑level deny lists, and monitor for other domains resolving to the same Cloudflare edge IP that reference Ledger. Continuous re‑scanning of the domain and its IP is advised, as the site may be re‑hosted. Incorporate the domain into threat‑intel feeds and alert SOC analysts when traffic to Cloudflare‑hosted IPs with similar naming patterns is observed.