liveledgerus[.]vercel[.]app

Analysis of liveledgerus.vercel.app indicates a recent brand‑impersonation campaign targeting Ledger. The domain was registered on 21 February 2026 through Tucows Domains Inc. and resolves to the Amazon‑owned address 64.29.17.3, ASN 16509, located in the United States. The site served a page whose title reads “Ledger® Live: Desktop | Getting started with Ledger,” directly referencing Ledger’s official product line, which satisfies the definition of a crypto‑related impersonation attempt. Infrastructure observations show the site was hosted on Vercel, employed HTTP Strict Transport Security, and presented a TLS certificate issued by Google Trust Services (WR1).

An HTTP 451 response code was observed, indicating that the content was unavailable for legal reasons at the time of testing; the site is currently offline. VirusTotal records show the URL was scanned by 95 antivirus and URL‑reputation engines, none of which flagged the domain, but the absence of detections does not constitute a safety confirmation. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the view that it is being treated as malicious by threat‑intel operators. The classification of “Crypto Scam” derives from the brand impersonation context rather than any observed payload.

Because the page content has not been captured, the exact malicious behavior—such as credential harvesting or malware delivery—remains uncertain. Defenders should add the domain and its hosting IP to outbound‑traffic deny lists, monitor for new Vercel‑hosted subdomains that mimic Ledger branding, and continue to review any future re‑hosting attempts. Ongoing intelligence collection is recommended to determine whether the campaign resumes or evolves, especially given the short registration window and the use of a reputable cloud provider to obscure attribution.