ledger-protect[.]xyz

The domain ledger-protect.xyz was registered on February 21, 2026 through Ultahost, Inc. and is hosted behind Cloudflare (nameservers agustin.ns.cloudflare.com, macy.ns.cloudflare.com). DNS resolution points to 104.21.91.129, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WE1 hierarchy, indicating a valid HTTPS endpoint. HTTP traffic is served over HTTP/3 and Cloudflare Browser Insights are present, suggesting typical Cloudflare front‑end services. The only visible HTML title is “Just a moment…”, which provides no functional context.

The site is classified as a crypto‑related brand impersonation targeting Ledger, and it has been identified as a crypto scam by intelligence sources. PhishDestroy has blocked the domain and it appears on one external security blocklist. VirusTotal analysis shows that 2 of 93 scanning engines flagged the domain, confirming some level of malicious behavior. The current operational status is offline, indicating that the site is no longer serving content at the time of this assessment. Defenders should note that the domain’s infrastructure is typical of fast‑flux or disposable phishing sites that leverage Cloudflare’s CDN to hide origin servers.

The presence of a legitimate‑looking SSL certificate can increase user trust, while the generic page title offers no immediate indication of malicious intent. Because the domain is already taken offline, active blocking may be unnecessary, but adding the domain to internal blocklists and monitoring for re‑use of the same IP address or Cloudflare account is advisable. Continuous watch of the registrar Ultahost, Inc. for new registrations that reuse similar naming patterns (e.g., “ledger‑protect”) can help pre‑empt future campaigns. Additionally, security teams should incorporate the two VirusTotal detections into threat‑intel feeds and ensure that any outbound traffic to 104.21.91.