undo-ledger[.]com

This domain, undo-ledger.com, is actively engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The site presents a fraudulent verification page titled 'Please verify,' designed to deceive users into entering sensitive credentials or recovery phrases. Such impersonation schemes are commonly used to facilitate cryptocurrency theft by tricking victims into disclosing private keys or wallet access details, leading to unauthorized fund transfers and irreversible asset loss. Analysis indicates the domain exhibits multiple high-risk indicators. It is flagged by 8 out of 95 security vendors on VirusTotal, demonstrating detection by a significant portion of the threat intelligence community. The domain was registered on July 02, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. It appears on one security blocklist and resolves to the IP address 172.67.190.120, which is hosted on a content delivery network known to obscure origin servers. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting visitors. Users who have visited undo-ledger.com or interacted with its content should immediately cease all engagement and take corrective actions. Any credentials or recovery phrases entered on the site should be considered compromised. Affected individuals must transfer remaining assets to a new, secure wallet using an unaffected device. It is recommended to monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. System scans using updated security tools should be performed to detect potential malware or backdoors installed during the interaction. Given the high-risk nature of this domain, all associated devices should be treated as potentially compromised until verified otherwise.