login-ledgger-load-io-queue[.]vercel[.]app

This domain is flagged as an active high-risk phishing site specializing in crypto asset theft through brand impersonation. Analysis indicates the infrastructure is designed to mimic legitimate hardware wallet interfaces, specifically targeting users of the Ledger platform. The threat type is classified as a crypto drainer, where victims are tricked into connecting wallets to malicious smart contracts, resulting in unauthorized fund transfers. Infrastructure analysis reveals the domain login-ledgger-load-io-queue.vercel.app was registered through Vercel on May 08, 2026, and resolves to the IP address 216.198.79.67, hosted by a provider in the United States. The SSL certificate is issued by Google Trust Services, adding a superficial layer of legitimacy. Detection metrics show 15 out of 95 security vendors on a major scanning platform have flagged the domain as malicious. The domain appears on three security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. The page title, 'Ledger® Hardware Wallet | Secure Your Crypto Assets,' closely mirrors the legitimate Ledger branding, further confirming the intent of brand impersonation. Mitigation against this threat requires heightened user awareness and technical safeguards. Users should verify domain authenticity by cross-referencing official communication channels before interacting with any wallet-related interface. Wallet software integrations should enforce strict origin checks to block connections to untrusted domains. Network-level protections, such as DNS filtering or IP-based blocking of 216.198.79.67, can prevent access to the malicious infrastructure. Organizations managing crypto assets should implement multi-signature requirements and hardware-based authentication to reduce the risk of unauthorized transactions. Given the domain's active status, continuous monitoring of related infrastructure is recommended to preempt potential redirects or newly registered variants.