ledgerpoint[.]cc

Analysis of ledgerpoint.cc indicates an active phishing domain impersonating Ledger, a hardware cryptocurrency wallet provider. The domain was registered on September 9, 2025, through Dynadot LLC and currently resolves to IP address 172.67.206.15. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3 and a Google Trust Services SSL certificate, alongside front-end technologies such as Tailwind CSS, Alpine.js, jsDelivr, and Google Analytics. The page title, 'ledgerpoint - Komplexní Účetní Služby pro Váš Růst,' suggests a localized fake service offering, though the exact content and functionality of the site remain unconfirmed. The domain is flagged by multiple threat intelligence sources, including 23 pulses on AlienVault OTX and two security blocklists. Detection engines PhishDestroy and BLP-Malware have blocked the domain, and five of 95 security vendors on VirusTotal have marked it as malicious. Despite these indicators, the domain remains active as of July 12, 2026, with a Gridinsoft trust score of 0/100. Defenders should treat this domain as high-risk for brand impersonation targeting Ledger users. Network-level blocking of 172.67.206.15 and the domain itself is recommended. Further investigation into associated infrastructure, such as Cloudflare configurations and third-party scripts (e.g., jsDelivr, Google Analytics), may reveal additional compromise indicators. No evidence currently links this domain to a specific phishing kit or campaign beyond the Ledger impersonation.