txncheck-ledger[.]com

This domain, txncheck-ledger.com, is identified as a brand impersonation phishing site specifically targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the domain is engineered to mimic legitimate Ledger transaction verification or wallet management interfaces, likely deploying credential-harvesting or wallet-draining scripts to exfiltrate private keys or recovery phrases from unsuspecting users. The threat type aligns with known crypto-phishing campaigns that exploit brand trust to facilitate unauthorized asset transfers. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 80.66.87.123 and was registered on November 02, 2025, through Dominet (HK) Limited. VirusTotal detection metrics show 10 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on two independent security blocklists and is actively blocked by MetaMask and SEAL, further corroborating its malicious classification. No association with legitimate Ledger infrastructure or DNS records was observed during analysis. Current status indicates the domain has been taken offline, likely in response to detection and reporting. However, residual risk persists due to potential re-registration or migration of the phishing kit to alternative domains. Users who interacted with this domain are advised to immediately revoke any connected wallet permissions, rotate recovery phrases, and monitor transaction histories for unauthorized activity. Network-level blocking of the associated IP (80.66.87.123) is recommended for proactive defense. Continuous monitoring for domain resurgence or similar impersonation attempts is warranted given the elevated risk profile.