ledgttruejd[.]xyz

Analysis indicates that ledgttruejd.xyz was registered on 18 November 2025 through Web Commerce Communications Limited. The authoritative name servers are gwen.ns.cloudflare.com and reese.ns.cloudflare.com, which place the domain under Cloudflare’s DNS infrastructure. The domain resolves to IP address 104.21.20.90, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate is presented for the host, meaning HTTPS connections are not available. The only visible page title, captured before the site was taken offline, reads “Sorry, the website has been stopped.” This title does not reveal any brand or service, and the page content has not been archived, leaving the exact phishing payload unknown.

The domain currently returns an offline status and is listed as blocked by PhishDestroy. Additionally, it appears on one external security blocklist, and the Gridinsoft trust score is 0 out of 100, indicating a lack of confidence in the host’s legitimacy. VirusTotal reports that 13 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion that the site was used for malicious activity. The presence of a Cloudflare‑provided IP, combined with the lack of an SSL certificate and the low trust rating, is consistent with infrastructure commonly adopted by short‑lived phishing operations. However, because the site is offline and no further forensic artifacts have been collected, the full scope of the campaign—including targeted brands, credential‑stealing mechanisms, or distribution vectors—remains uncertain.

Defenders should immediately add ledgttruejd.xyz to web‑filter blocklists and enforce DNS‑level denial for the associated IP range. Monitoring for any future re‑registration of the domain or reuse of the same IP address is advised. Because the domain is already flagged by PhishDestroy and a security blocklist, existing threat‑intel feeds should be updated to reflect its elevated risk level.