wallet-ladger-livelogin[.]vercel[.]app

This domain is flagged as an elevated-risk credential theft operation specifically targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the infrastructure was designed to harvest login credentials under the guise of legitimate Ledger Live authentication, a tactic commonly associated with cryptocurrency drainer schemes. The threat type is classified as brand impersonation with a focus on credential compromise, potentially leading to unauthorized access to digital asset wallets. Infrastructure analysis reveals the domain wallet-ladger-livelogin.vercel.app was registered through Vercel Inc., a platform commonly exploited for rapid deployment of fraudulent pages. The domain resolved to IP address 64.29.17.67, geolocated within the United States under Amazon.com, Inc.'s AS16509 autonomous system. The SSL certificate was issued by Google Trust Services (WR1), a legitimate provider often leveraged to lend credibility to malicious sites. Detection metrics show the domain appeared on two security blocklists—PhishDestroy and PhishingDB—while VirusTotal reported 21 out of 95 security vendors flagged the domain as malicious. The page title, 'Ledger® Live Login® (en-US) | Ledger Support,' closely mimics official Ledger branding, increasing the likelihood of successful deception. Mitigation against this credential theft operation requires immediate user awareness and technical controls. Users should verify domain authenticity by cross-referencing URLs with official Ledger communication channels and avoid entering credentials on untrusted sites. Organizations should implement DNS-based blocking for the domain and its associated IP address, while monitoring for similar Vercel-hosted subdomains impersonating cryptocurrency services. Multi-factor authentication (MFA) should be enforced for all wallet access to mitigate the impact of credential compromise. Security teams are advised to review logs for connections to 64.29.17.67 and correlate with other indicators of compromise, such as anomalous login attempts or unauthorized transaction requests.