qr[.]update-ledger[.]gl

This domain is flagged for brand impersonation, specifically targeting Ledger, a hardware cryptocurrency wallet provider. The threat type involves mimicking the official Ledger interface to deceive users into disclosing sensitive credentials or installing malicious software, potentially leading to unauthorized access to cryptocurrency assets. The risk level is classified as elevated due to the domain's deceptive design and active distribution methods, despite its current offline status. Analysis indicates the domain qr.update-ledger.gl was registered on April 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.55.82, hosted on Cloudflare infrastructure in Canada. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, and it appears on one security blocklist. The page title, 'Ledger Wallet Crypto Wallet App | Ledger,' directly impersonates the official Ledger branding, reinforcing the phishing intent. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP address (104.21.55.82) across all network security controls. Organizations should update endpoint protection rules to detect and prevent access to domains registered via NICENIC INTERNATIONAL GROUP CO., LIMITED, particularly those impersonating cryptocurrency-related brands. Users should be educated to verify domain authenticity by cross-referencing official communications from Ledger, avoiding links in unsolicited messages, and inspecting SSL certificates for anomalies. Additionally, monitoring for similar domains with recent creation dates (e.g., post-April 2026) and Cloudflare-hosted infrastructure can help preemptively identify related threats.