cloud-ledger-transaction-check[.]com

This domain, cloud-ledger-transaction-check.com, poses a high-risk brand impersonation threat specifically targeting Ledger cryptocurrency wallet users. Analysis indicates the site was designed to mimic legitimate Ledger transaction verification interfaces, likely functioning as a crypto drainer or credential harvester. The infrastructure was structured to deceive users into entering wallet recovery phrases, private keys, or executing malicious transactions under the guise of verifying or synchronizing their Ledger devices. Such attacks typically result in immediate and irreversible theft of digital assets from connected wallets. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on October 12, 2025, through Dominet (HK) Limited, a registrar frequently associated with phishing campaigns. It resolved to the IP address 80.66.87.123, hosted on AS216127 (INTERNATIONAL HOSTING COMPANY LIMITED) in Germany, with no SSL certificate present. Detection engines on VirusTotal flagged the domain as malicious in 11 out of 95 security vendor scans. Additionally, the domain appears on three independent security blocklists, and was proactively blocked by at least three major threat intelligence platforms prior to takedown. Users who visited cloud-ledger-transaction-check.com or interacted with its content should assume potential compromise of sensitive wallet credentials. Immediate action is required: revoke any connected wallet sessions, generate new wallet addresses, and transfer remaining assets to a secure, air-gapped environment. Monitor all associated accounts for unauthorized transactions. If recovery phrases or private keys were entered, consider the original wallet permanently compromised. Report the incident to relevant blockchain security teams and maintain heightened vigilance for follow-up phishing attempts via email or social engineering vectors.