app[.]financeglobal[.]trade

The domain app.financeglobal.trade is a confirmed phishing site engaged in brand impersonation targeting users of the cryptocurrency platform ankr. It presents itself as a legitimate hardware wallet service, specifically mimicking Ledger's branding with the page title 'Hardware Wallet & Cold Wallet - Security for Crypto | Ledger', to deceive victims into entering sensitive information such as seed phrases. This is classified as a seed-phishing scam, not a crypto drainer. The site is currently taken offline, but it remains a documented threat.

Technical indicators show app.financeglobal.trade had 0 of 95 VirusTotal vendors flagging it as malicious, and Google Safe Browsing did not detect it. The domain appears on 2 security blocklists: PhishDestroy and ScamSniffer. It was registered through the registrar arin, though the creation date is not available. The site resolved to the IPv6 address 2a06:98c1:3121::3, hosted on Cloudflare's network (AS13335) in the US. No SSL certificate was present, and the Scamadviser trust score was 25 out of 100. The domain used a single nameserver.

Victims who interacted with app.financeglobal.trade should immediately revoke any token approvals and transfer funds to a new, secure wallet to prevent potential theft. Change passwords for any accounts accessed or entered on the site, enable two-factor authentication, and monitor for unauthorized transactions. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand's security team (ankr) to aid in takedown efforts and protect others.