pqc-ledger[.]gd

The domain pqc-ledger.gd actively impersonates the Ledger brand, a well-known cryptocurrency hardware wallet provider, to execute phishing attacks. Despite its recent creation on May 17, 2026, it has already been flagged by 3 out of 92 vendors on VirusTotal, indicating early detection of its malicious nature. The domain is hosted on an IP address in Canada, under Cloudflare, Inc., and uses an SSL certificate issued by Let's Encrypt.

This domain employs cloaking techniques, scoring 4 out of 10, to serve benign content to security scanners while displaying phishing content to unsuspecting users. This tactic complicates detection and allows the domain to remain active longer before being shut down. The page title misleadingly reads 'Google', further attempting to disguise its true intent and lure victims into a false sense of security.

Public blocklists, including those from PhishDestroy, MetaMask, and SEAL, have already listed pqc-ledger.gd, highlighting the threat it poses to cryptocurrency users. With a platform risk score of 88 out of 100, this domain represents a significant risk to individuals who may inadvertently disclose sensitive information, such as recovery phrases or private keys, believing they are interacting with the legitimate Ledger site. The registrar, NICENIC INTERNATIONAL GROUP CO., LIMITED, is noted for its role in registering this deceptive domain. Immediate attention and action are required to mitigate the risks associated with this phishing operation.