updateterms[.]com

This domain, updateterms.com, is identified as a brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. The site mimics the Ledger Live interface, a software platform used for managing crypto assets, with the explicit page title 'Ledger Live.' Analysis indicates the domain is designed to deceive users into interacting with fraudulent wallet management tools, likely deploying a cryptocurrency drainer kit to siphon digital assets from victims' wallets. No specific drainer kit variant has been confirmed, but the infrastructure aligns with known crypto-theft campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 216.198.79.1, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. Detection metrics show 22 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on a single security blocklist, PhishDestroy. The domain's SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its accessibility. No entries were found in Google Safe Browsing at the time of analysis. As of the latest assessment, updateterms.com has been taken offline, reducing immediate exposure to end users. However, the domain's infrastructure remains registered, and the registrar has not taken further action to suspend or seize the asset. The elevated risk level persists due to the domain's recent creation date, association with a known high-risk registrar, and the persistent threat of re-deployment under a new IP or subdomain. Users are advised to monitor wallet transactions for unauthorized activity and verify domain authenticity before interacting with any Ledger-related services. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.