ledger-defi[.]firebaseapp[.]com

This domain, ledger-defi.firebaseapp.com, is actively engaged in brand impersonation targeting Ledger, a well-known hardware wallet provider. The site presents itself as an official Ledger portal, using the page title 'Hardware Wallet & Crypto Wallet - Security for Crypto | Ledger' to deceive users into believing they are interacting with legitimate infrastructure. Analysis confirms the domain remains operational and is designed to harvest sensitive credentials or distribute malicious payloads under the guise of cryptocurrency security services. Infrastructure analysis reveals the domain is registered through Google Firebase and resolves to the IPv6 address 2620:0:890::100, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WR4), a common characteristic of phishing sites leveraging legitimate cloud services to evade detection. Security vendor assessments indicate the domain is flagged by 1 of 95 vendors on VirusTotal, while it appears on four distinct security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. No creation date is publicly disclosed, but the domain's active status and technical indicators suggest recent deployment. Current intelligence confirms ledger-defi.firebaseapp.com remains active and poses a high risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to prevent access. Users who may have interacted with the site should immediately revoke any credentials entered, monitor accounts for unauthorized activity, and consider resetting hardware wallet configurations if sensitive data was exposed. Security teams should treat this domain as a confirmed threat vector and prioritize its inclusion in threat intelligence feeds and automated blocking mechanisms.