eng-app-ledrlive[.]created[.]app

The domain eng-app-ledrlive.created.app was registered on July 12, 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.1.193, an Amazon.com, Inc. host in the United States (AS16509). DNS resolution uses Vercel’s authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the site was deployed on the Vercel platform. The HTTPS service presents a Let’s Encrypt R13 certificate and enforces HTTP Strict Transport Security, confirming that the site was reachable over TLS. An HTTP request to the root returned a 404 status code, yet the page title captured in the intelligence set is "Download and install Ledger Wallet™," explicitly referencing the Ledger brand. The page title and the label "brand impersonation" together identify the infrastructure as a crypto‑related scam attempting to mimic Ledger’s legitimate wallet offering.

VirusTotal analysis recorded detections by six of ninety‑five scanning engines, and the domain is listed on at least one external security blocklist. PhishDestroy has already taken the site offline, and the current status is recorded as offline. The presence of Vercel hosting, a public cloud IP, and a LetsEncrypt certificate are typical of fast‑deployment phishing kits, but no additional details about the underlying code or payload have been observed. Because the site is no longer live, direct verification of malicious content is not possible, leaving uncertainty around the exact phishing flow, credential capture mechanisms, or any additional payload distribution.

Defenders should continue to block the domain at network perimeter and DNS layers, add the observed IP address to host‑based deny lists, and monitor for any re‑registration of similar subdomains on the same Vercel nameservers. Email security gateways should enforce strict filtering for messages claiming to originate from Ledger, especially those containing attachment types or links that reference "download" or "install" Ledger wallets.