ledger[.]newtxc[.]com

ledger.newtxc.com was registered on 27 February 2026 through OwnRegistrar, Inc. The domain resolves to IP 193.24.123.124, which belongs to AS200593 PROSPERO OOO in Russia. Authoritative nameservers sureena.ns.cloudflare.com and zod.ns.cloudflare.com indicate the attacker used Cloudflare DNS services to increase resilience and conceal the true hosting environment. No TLS certificate is presented, leaving any communication unencrypted and vulnerable to passive interception. VirusTotal analysis shows that 18 of 93 security scanners flagged the domain, and PhishDestroy has already taken the site offline.

The threat profile identifies the domain as impersonating Ledger and categorises the activity as a crypto‑related scam, confirming a brand‑impersonation motive aimed at Ledger users. The presence on a single security blocklist and the lack of an SSL certificate are consistent with a quickly deployed malicious landing page that was subsequently shut down. Current intelligence does not include a captured page title, Safe Browsing verdict, or detailed payload information, so the exact user‑facing content and credential‑ harvesting techniques remain unknown. Defenders should immediately block ledger.newtxc.com and its IP address at firewalls, DNS resolvers, and email gateways.

Continuous monitoring of the associated IP range and the Cloudflare nameservers is recommended to detect any re‑registration or migration to new infrastructure. Given the elevated risk rating, security teams should also audit endpoint logs for attempts to contact the IP, especially from devices that manage Ledger wallets, and correlate DNS queries for ledger.newtxc.com with authentication events to Ledger services. Adding the indicators to internal threat‑intelligence feeds and sharing them with industry partners will help accelerate detection of future impersonation campaigns targeting Ledger customers.