openledgercheck[.]xyz

openledgercheck.xyz was registered through NiceNIC International Group Co., Limited on 3 September 2025. The domain resolves to 172.67.186.228, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. Nameserver delegation points to josh.ns.cloudflare.com and jule.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented; HTTP requests return a generic “Just a moment…” page title, indicating the site is currently serving a placeholder or challenge page. The site is categorized as a crypto‑related scam, specifically an “Airdrop Scam” kit that commonly lures victims with promises of free tokens in exchange for private keys or seed phrases.

The brand target is Ledger, and the domain name is crafted to suggest a Ledger verification service, satisfying the observed brand‑impersonation profile. Threat‑intel aggregators have recorded the domain on a single blocklist; PhishDestroy currently lists it as blocked. VirusTotal scans show six of ninety‑five AV engines flag the domain, reinforcing the malicious assessment. Gridinsoft’s trust score is 0 / 100, reflecting a high confidence of abuse. The site’s operational status is marked offline, and no SSL certificate is available, limiting the ability to capture further payloads.

No public Safe Browsing or OTX entries were found for this host at the time of analysis. Defenders should add openledgercheck.xyz and its resolving IP 172.67.186.228 to deny‑list controls, enforce DNS filtering for Cloudflare‑hosted addresses associated with this domain, and monitor for any re‑registration attempts. Network sensors should flag outbound connections to the IP and any HTTP requests that return the “Just a moment…” title. Because the underlying phishing kit is an Airdrop Scam, security teams should also educate users about unsolicited Ledger‑related airdrop offers and advise verification only through official Ledger channels.