ledger-updatesetup[.]com

Analysis of ledger-updatesetup.com indicates a confirmed crypto scam impersonating Ledger, a hardware wallet provider. The domain was registered on December 26, 2025, through NiceNIC International Group Co., Limited, and resolves to the IP address 144.172.101.164, hosted under AS14956 (RouterHosting LLC) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'Transaction Check® - Ledger,' directly aligns with the reported scam type targeting cryptocurrency transactions, suggesting an intent to deceive users into submitting sensitive wallet or transaction details.

The domain appears on one security blocklist (PhishDestroy) and is flagged by 15 of 93 security vendors on VirusTotal, confirming malicious classification. AlienVault OTX includes it in one threat intelligence pulse, further corroborating its association with phishing infrastructure. Nameservers ns3.my-ndns.com and ns4.my-ndns.com are consistent with low-reputation DNS providers often utilized in fraudulent operations. As of the report date, the domain is offline, though this status may change; defenders should treat it as compromised infrastructure.

Given the absence of SSL, the use of a recently registered domain, and the direct impersonation of a cryptocurrency brand, this infrastructure poses an elevated risk. Network defenders are advised to block the domain and IP at perimeter controls, monitor for related domains registered through the same registrar or hosting provider, and alert users to potential crypto-themed phishing attempts. The exact content of the site remains unanalyzed, but the available evidence supports its classification as a crypto scam targeting Ledger users.