ledger-defi[.]web[.]app

The domain ledger-defi.web.app is currently under investigation for brand impersonation, targeting the well-known cryptocurrency security brand Ledger. This domain is suspected of being a phishing site designed to deceive users into providing sensitive information, such as login credentials or private keys, which could lead to financial loss or unauthorized access to their cryptocurrency wallets.

Infrastructure analysis reveals that the domain is registered through Google Firebase and resolves to the IP address 199.36.158.100, which is located in the United States and is part of the AS54113 Fastly, Inc. network. The domain has been flagged by 11 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The SSL certificate is issued by Google Trust Services / WR4, which may lend a false sense of security to unsuspecting users. The domain is also listed on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, suggesting that it has been identified as a threat by multiple security organizations.

As of the latest assessment, the domain remains active and continues to pose a high risk to users. Immediate response actions include warning potential victims through security advisories and collaborating with domain registrars and hosting providers to take down the site. Users are advised to verify the URL of the official Ledger website and to avoid entering any personal or financial information on this domain. Despite these efforts, the risk remains significant as the domain continues to impersonate a trusted brand, and further monitoring and action are required to mitigate the threat.