led-net1-9cjf[.]vercel[.]app

This domain is flagged for elevated-risk brand impersonation, specifically targeting Ledger, a cryptocurrency hardware wallet provider. The threat involves a fraudulent login page designed to harvest user credentials, likely for unauthorized access to Ledger Live accounts and associated cryptocurrency assets. Infrastructure analysis indicates the domain is constructed to closely resemble legitimate Ledger support pages, increasing the likelihood of successful deception. Analysis reveals the domain led-net1-9cjf.vercel.app is currently offline but was previously active on 2 security blocklists (PhishDestroy, PhishingDB). It resolves to IP 64.29.17.195, hosted on Amazon.com, Inc. (AS16509) infrastructure in the US. The domain is registered through Vercel Inc., and its SSL certificate is issued by Google Trust Services (WR1). VirusTotal detection shows 20 out of 95 security vendors flagging the domain as malicious. The page title, "Ledger® Live Login® (en-US) | Ledger Support," directly mimics official Ledger branding, reinforcing its deceptive intent. Mitigation steps for this threat type include immediate blacklisting of the domain and associated IP (64.29.17.195) across all network security controls. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate issuer (Google Trust Services / WR1) into endpoint detection and response (EDR) systems. Users should be educated on verifying domain authenticity before entering credentials, particularly for cryptocurrency-related services. Additionally, monitoring for similar Vercel-registered domains with Ledger-themed page titles can help preempt future impersonation attempts.