rococo-snickerdoodle-5093f6[.]netlify[.]app

This domain operates as an active phishing infrastructure designed to impersonate Ledger, a hardware cryptocurrency wallet provider. The site presents a fraudulent "Connect Wallet" interface, tricking users into entering sensitive credentials or recovery phrases under the pretense of legitimate wallet integration. Such attacks typically target cryptocurrency holders, aiming to exfiltrate private keys or seed phrases to gain unauthorized access to digital assets. The domain’s design and functionality closely mimic Ledger’s official wallet connection workflow, increasing the likelihood of successful deception among unsuspecting users.

Analysis indicates the domain is hosted on Netlify’s platform and resolves to the IP address 18.208.88.157, located within Amazon’s AS14618 network in the United States. The SSL certificate, issued by DigiCert Inc under the "DigiCert Global G2 TLS RSA SHA256 2020 CA1" chain, provides a veneer of legitimacy while failing to mitigate the underlying threat. Detection metrics reveal minimal but concerning coverage: only 1 of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on a single security blocklist. The domain remains active as of this report, with no indications of takedown or remediation efforts.

Users who have interacted with this domain should immediately cease all engagement and revoke any connected wallet permissions. If credentials or recovery phrases were entered, affected parties must transfer assets to a new, secure wallet and monitor for unauthorized transactions. Additionally, devices used to access the site should undergo a thorough security scan to detect potential malware or backdoors. Cryptocurrency holders are advised to verify domain authenticity through official channels before entering sensitive information, as phishing campaigns frequently exploit brand trust to facilitate financial theft.