friendsledger[.]com

This domain, friendsledger.com, poses a targeted brand impersonation threat against users of Ledger hardware wallets. Analysis indicates the site mimics legitimate Ledger interfaces, specifically designed to trick visitors into entering sensitive recovery phrases or private keys. Such credentials, once compromised, enable attackers to drain cryptocurrency wallets irreversibly. The page title 'Friends Ledger' and use of modern web technologies like React and Firebase suggest an attempt to appear credible while harvesting credentials. Infrastructure analysis reveals the domain was registered on March 23, 2026, through TuringSign Inc. d/b/a Cosmotown, a registrar with historical associations to high-risk domains. The site resolves to IP address 76.76.21.22 and employs a Let's Encrypt SSL certificate, which, while standard for encryption, is frequently abused in phishing campaigns. Detection metrics show 2 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk entity. Users who visited friendsledger.com or entered any sensitive information should immediately cease all interaction with the site. First, revoke any connected wallet permissions and transfer remaining assets to a new, secure wallet using a verified recovery phrase. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to the impersonated brand's official security team and consider filing a complaint with domain registrars or relevant cybersecurity organizations to aid in takedown efforts. Given the irreversible nature of cryptocurrency theft, prompt action is critical to mitigate potential losses.