Known malicious kitcriticalphishing
Ledger 'device verification' phishing behind decoy store sites and a cloaking service
family: cloakit-ledger-verification-2026-11
Short link:scanmalware.com/h/343
E-mails posing as Ledger ('Action Needed: Device Firmware Update Required') link to look-alike domains that show an empty placeholder shop titled 'Home | Store'. Any other path on those domains is a redirect page that asks a cloaking service whether the visitor is worth sending on; real visitors go to a fake Ledger 'device verification' site with a captcha step, followed by a page that asks for the wallet's recovery phrase. Datacenter and VPN visitors are sent to a harmless site or to an unregistered domain instead.
Anchors
Hunting ruleCloakit_NextJS_Lure_Redirector
SMQL queryrun
contacted_host:ogenhoallin.com OR hunting_rule:Cloakit_Ledger_Verification_Lure_App OR cookie_name:cloakit_trusted OR (fp_content:3fd96744e56e47e04dc23a473ad61cbc0d31fba54666d0b26039d773b641ac2e AND title:"Home | Store") OR contacted_host:device.ledger-signature.live OR contacted_host:device.ledger-config.live OR contacted_host:device.access-ledger.appProvenance
Added: 2026-11-03 19:34
The decoy domains mix wallet words (ledger, lgr, nanosplus, wallet), exchange names (okx) and generic account words (sync, sso, id, review, lookup, privacy, conditions) on .at, .to and .com; the verification sites sit on device.* and backup.* subdomains of .live and .app domains. The same pages have been in use since at least March 2026.
Sightings (114)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| 11-okx.com | b0d4a2cb… | https://11-okx.com/_next/static/chunks/ba31fbc4b0a065f3.js | rule | 2026-11-03 20:31 |
| review-lgr.at | 58663df6… | https://review-lgr.at/_next/static/chunks/ba31fbc4b0a065f3.js | rule | 2026-11-03 20:31 |
| sync-auth.at | bec5756e… | https://sync-auth.at/_next/static/chunks/ba31fbc4b0a065f3.js | rule | 2026-11-03 20:30 |
| wallet-update.at | 22fca0b3… | — | query | 2026-11-03 20:30 |
| visit-lgr.at | 2fa73c96… | — | query | 2026-11-03 20:29 |
| syncreview.to | e442bb0e… | — | query | 2026-11-03 20:29 |
| sync-link.to | 6102fb0b… | — | query | 2026-11-03 20:28 |
| sync-auth.at | d75f2789… | — | query | 2026-11-03 20:28 |
| settings-sso.to | e9814387… | — | query | 2026-11-03 20:27 |
| review-lgr.at | a14551c3… | — | query | 2026-11-03 20:27 |
| review-integrate.at | 0c996b71… | — | query | 2026-11-03 20:26 |
| review-id.to | 8395af78… | — | query | 2026-11-03 20:26 |
| backup-ledger.at | 3ee38f33… | — | query | 2026-11-03 20:25 |
| auth-sync.to | dc64195b… | — | query | 2026-11-03 20:25 |
| app-review.to | 35f97d38… | — | query | 2026-11-03 20:24 |
| 11-okx.com | f9adc4bc… | — | query | 2026-11-03 20:24 |
| device.webautorize-ledger.app | 247559bd… | — | query | 2026-11-03 20:23 |
| device.version-ledger.app | 4419024d… | — | query | 2026-11-03 20:23 |
| device.verification-ledger.app | 7cfc6b98… | — | query | 2026-11-03 20:22 |
| device.sync-ledger.app | bfa98bb4… | — | query | 2026-11-03 20:22 |
| device.synchronization-ledger.app | 0723158d… | — | query | 2026-11-03 20:21 |
| device.sso-ledger.live | 4c235814… | — | query | 2026-11-03 20:21 |
| device.sso-ledger.app | 43b877a0… | — | query | 2026-11-03 20:20 |
| device.software-ledger.app | c2978102… | — | query | 2026-11-03 20:20 |
| device.snapshot-ledger.app | 625e2a7c… | — | query | 2026-11-03 20:19 |
| device.signin-ledger.app | 7134143c… | — | query | 2026-11-03 20:19 |
| device.signature-ledger.app | d76d34cb… | — | query | 2026-11-03 20:18 |
| device.seed-ledger.app | c131a4d0… | — | query | 2026-11-03 20:18 |
| device.safeguard-ledger.app | 975140df… | — | query | 2026-11-03 20:17 |
| device.review-ledger.app | 56c90dd2… | — | query | 2026-11-03 20:17 |
| device.restore-ledger.app | 1bb3afbe… | — | query | 2026-11-03 20:16 |
| device.reinstate-ledger.app | 48c659cc… | — | query | 2026-11-03 20:16 |
| device.reinstall-ledger.app | 982cb0fa… | — | query | 2026-11-03 20:15 |
| device.recognize-ledger.app | 8791df4b… | — | query | 2026-11-03 20:15 |
| device.profile-ledger.app | 4cfd7ee8… | — | query | 2026-11-03 20:14 |
| device.privacy-ledger.app | 8f706d08… | — | query | 2026-11-03 20:14 |
| device.platform-ledger.live | 4f245ca0… | — | query | 2026-11-03 20:13 |
| device.platform-ledger.app | 3514c18e… | — | query | 2026-11-03 20:13 |
| device.patch-ledger.app | c599489e… | — | query | 2026-11-03 20:12 |
| device.passkey-ledger.app | 6594ce48… | — | query | 2026-11-03 20:12 |
| device.oauth-ledger.app | cf5614cf… | — | query | 2026-11-03 20:11 |
| device.mywallet-ledger.app | 7c7c91ef… | — | query | 2026-11-03 20:11 |
| device.myid-ledger.app | 1a125124… | — | query | 2026-11-03 20:10 |
| device.myapp-ledger.live | 5165761e… | — | query | 2026-11-03 20:10 |
| device.mnemonic-ledger.app | 102d74f4… | — | query | 2026-11-03 20:09 |
| device.ledger-sso.live | 04aba486… | — | query | 2026-11-03 20:09 |
| device.ledger-settings.live | 7fc5ef13… | — | query | 2026-11-03 20:08 |
| device.ledger-review.live | 49a2de99… | — | query | 2026-11-03 20:08 |
| device.ledger-authorize.live | 7b30826b… | — | query | 2026-11-03 20:07 |
| device.ledger-authentication.live | e609b851… | — | query | 2026-11-03 20:07 |
| device.ledger-account.live | 139e7907… | — | query | 2026-11-03 20:06 |
| device.ledger-access.live | 4a8a81b3… | — | query | 2026-11-03 20:06 |
| device.integrity-ledger.app | c8ba082f… | — | query | 2026-11-03 20:05 |
| device.integrate-ledger.app | d7aae552… | — | query | 2026-11-03 20:05 |
| device.import-ledger.app | 602cba68… | — | query | 2026-11-03 20:04 |
| device.id-ledger.app | db3cb708… | — | query | 2026-11-03 20:04 |
| device.identity-ledger.app | 101ee8b0… | — | query | 2026-11-03 20:03 |
| device.identification19-ledger.live | 60abfcc0… | — | query | 2026-11-03 20:03 |
| device.identification18-ledger.app | f3cde481… | — | query | 2026-11-03 20:02 |
| device.identification17-ledger.live | 8994ca19… | — | query | 2026-11-03 20:02 |
| device.identification15-ledger.app | c01170db… | — | query | 2026-11-03 20:01 |
| device.identification14-ledger.app | 1bb33282… | — | query | 2026-11-03 20:01 |
| device.gateway-ledger.app | 4ee1dea0… | — | query | 2026-11-03 20:00 |
| device.enroll-ledger.app | 0b563de0… | — | query | 2026-11-03 20:00 |
| device.dashboard-ledger.app | 52fe6359… | — | query | 2026-11-03 19:59 |
| device.credential-ledger.app | 9b5148a4… | — | query | 2026-11-03 19:58 |
| device.core-ledger.app | 7d56f6e1… | — | query | 2026-11-03 19:58 |
| device.connect-ledgerwallet.live | 8e8d96ad… | — | query | 2026-11-03 19:57 |
| device.confirmation-ledger.app | 98a362bd… | — | query | 2026-11-03 19:57 |
| device.certify-ledger.live | 5d339c6c… | — | query | 2026-11-03 19:56 |
| device.bip39-ledger.app | b7a607f4… | — | query | 2026-11-03 19:56 |
| device.authorize03-ledger.live | 448b0c82… | — | query | 2026-11-03 19:55 |
| device.authorize02-ledger.live | c9416195… | — | query | 2026-11-03 19:55 |
| device.authorize02-ledger.app | 481fbfa2… | — | query | 2026-11-03 19:54 |
| device.authorize01-ledger.live | eedcc6af… | — | query | 2026-11-03 19:54 |
| device.authorize01-ledger.app | 62e9dfbe… | — | query | 2026-11-03 19:53 |
| device.authorization63-ledger.live | dbbacc3f… | — | query | 2026-11-03 19:53 |
| device.authorization62-ledger.live | c8d24c86… | — | query | 2026-11-03 19:52 |
| device.authorization61-ledger.live | 7e0c9409… | — | query | 2026-11-03 19:52 |
| device.authorization32-ledger.live | 9a53ddb7… | — | query | 2026-11-03 19:51 |
| device.authorization31-ledger.live | 3930f645… | — | query | 2026-11-03 19:51 |
| device.authorization31-ledger.app | 0d38598c… | — | query | 2026-11-03 19:50 |
| device.authorization30-ledger.live | 901b9fd6… | — | query | 2026-11-03 19:50 |
| device.authorization28-ledger.live | 3124a704… | — | query | 2026-11-03 19:49 |
| device.authorization27-ledger.live | 58c34a2c… | — | query | 2026-11-03 19:49 |
| device.authorization26-ledger.live | caa160ab… | — | query | 2026-11-03 19:48 |
| device.authorization09-ledger.app | c7d12ec7… | — | query | 2026-11-03 19:48 |
| device.authentication14-ledger.app | 758d3d51… | — | query | 2026-11-03 19:47 |
| device.auth45-ledger.live | ea0f4b26… | — | query | 2026-11-03 19:47 |
| device.auth16-ledger.app | ab82c37e… | — | query | 2026-11-03 19:46 |
| device.auth03-ledger.app | 7dbba49a… | — | query | 2026-11-03 19:46 |
| backup.ledger-review.app | a0b1c969… | — | query | 2026-11-03 19:45 |
| termprivacy.com | fe8d2988… | — | query | 2026-11-03 19:13 |
| id-ownership.at | 9d74d7fe… | — | query | 2026-11-03 19:13 |
| request-sync.to | ab2c7c51… | — | query | 2026-11-03 19:13 |
| integrate-sync.to | 9a945a75… | — | query | 2026-11-03 19:13 |
| apple-conditions.com | d513eaff… | https://apple-conditions.com/_next/static/chunks/ba31fbc4b0a065f3.js | rule | 2026-11-03 19:12 |
| visit-ledger.at | 3628e3a3… | — | query | 2026-11-03 19:12 |
| identify-ledger.at | 3136271d… | — | query | 2026-11-03 19:12 |
| auth-ledger.at | 816a6a1a… | — | query | 2026-11-03 19:12 |
| apple-conditions.com | ae7cb5d8… | — | query | 2026-11-03 17:47 |
| device.ledger-signature.live | 8709997a… | — | query | 2026-11-03 16:47 |
| apple-condition.com | f851cd41… | — | query | 2026-11-03 16:47 |
| authy-ledger.at | 554645b8… | — | query | 2026-11-01 05:44 |
| sync-user.to | f43367b2… | — | query | 2026-11-01 04:59 |
| report-okx.com | 353b88e1… | — | query | 2026-11-01 04:58 |
| sync-app.at | d37596cb… | — | query | 2026-11-01 04:58 |
| link-ledger.at | b08d1a1f… | — | query | 2026-11-01 04:57 |
| id-review.at | 40fc36e5… | — | query | 2026-11-01 04:57 |
| sso-sync.at | 1a681576… | — | query | 2026-11-01 04:56 |
| device.ledger-config.live | 4efb5e6f… | — | query | 2026-11-01 04:55 |
| lookup-lgr.to | ef086662… | — | query | 2026-11-01 04:54 |
| device.access-ledger.app | c88956c1… | — | query | 2026-10-09 11:01 |
| device.access-ledger.app | 341d04dc… | — | query | 2026-10-09 08:00 |