ledger[.]tx-check[.]com

The domain ledger.tx-check.com was observed hosting a cryptocurrency‑related fraud campaign targeting users of the Ledger hardware‑wallet brand. VirusTotal records show that 17 of 95 scanned security engines flagged the domain as malicious, indicating a consensus among multiple scanners. The site lacked an SSL certificate, which is consistent with the observed infrastructure. DNS resolution points to the IPv4 address 193.143.1.67, an IP range registered to Proton66 OOO in Russia (AS198953).

Whois data reveals the domain was created on 21 October 2025 and registered through OwnRegistrar, Inc., using Cloudflare nameservers evelyn.ns.cloudflare.com and jerry.ns.cloudflare.com. The infrastructure received a Gridinsoft trust score of 0 out of 100, reflecting a high confidence in its malicious nature. The campaign was classified as a “Crypto Scam” and is listed on one external security blocklist; it has also been blocked by the PhishDestroy service.

Current host status is reported as offline, limiting live content analysis, but the combination of detection counts, low trust score, and registrar information provides sufficient evidence for defensive actions. Defenders should add the domain and its resolving IP address to network deny lists, monitor for any re‑registration attempts, and ensure that endpoint protection solutions incorporate the observed VirusTotal detections. Continuous observation of the associated ASN (AS198953) for new malicious registrations is recommended, as is verification that any future Ledger‑related communications employ valid TLS certificates and originate from known Ledger infrastructure.