help-ledger-login[.]vercel[.]app

This domain, help-ledger-login.vercel.app, is flagged as a brand impersonation phishing site targeting Ledger hardware wallet users. Analysis indicates the site presents a fraudulent Ledger® Live login interface, designed to harvest cryptocurrency wallet credentials and recovery phrases. The page title, 'Ledger® Live Login® (en-US) | Ledger Support,' mimics official Ledger branding to deceive victims into entering sensitive authentication details. Infrastructure analysis reveals the domain was registered through Vercel Inc. and resolves to IP address 216.198.79.3, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain is detected by 21 out of 95 security vendors on VirusTotal, with an SSL certificate issued by Google Trust Services (WR1). It appears on two security blocklists and was previously blocked by PhishDestroy and PhishingDB. No creation date is available, but the domain's hosting pattern aligns with known phishing campaigns leveraging Vercel's platform for rapid deployment. The domain is currently offline, likely following takedown actions or automated detection. However, residual risk remains due to the potential reuse of the same infrastructure or tactics by threat actors. Users who interacted with this domain should immediately revoke any entered credentials, enable multi-factor authentication on all cryptocurrency wallets, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.