update-ledger[.]gl

This domain, update-ledger.gl, poses a direct threat to cryptocurrency wallet security by impersonating Ledger, a well-known hardware wallet manufacturer. The site is designed to harvest user credentials, including private keys, recovery phrases, and login details, under the guise of a legitimate software update or account verification process. Given the irreversible nature of cryptocurrency transactions, compromised credentials could lead to immediate and total asset loss for victims. The site employs deceptive tactics such as mimicking the Google page title to evade suspicion and may use social engineering to prompt urgent action from users. Analysis indicates this domain is malicious based on multiple technical indicators. It is flagged by 16 out of 95 security vendors on VirusTotal, placing it in the top 17% of detected threats by vendor consensus. The domain was registered on April 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL, further confirming its malicious intent. Infrastructure analysis reveals the domain resolves to IP address 172.67.145.248, which has been linked to other phishing campaigns targeting financial and cryptocurrency services. If you visited update-ledger.gl or entered any credentials, take immediate action to secure your assets. First, disconnect the device used to access the site from the internet to prevent ongoing data exfiltration. Next, revoke any active sessions or authorizations linked to your Ledger or cryptocurrency accounts. If you provided a recovery phrase, private key, or password, assume your wallet is compromised and transfer all assets to a new, secure wallet immediately. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to your wallet provider and consider filing a report with relevant cybersecurity authorities or blockchain analytics platforms to track the threat.