hlp-lger[.]zapier[.]app

This domain, hlp-lger.zapier.app, is actively engaged in brand impersonation targeting Ledger, a well-known cryptocurrency hardware wallet provider. The threat type is specifically classified as brand impersonation, designed to deceive users into interacting with fraudulent infrastructure under the guise of legitimate Ledger services. The domain remains active and poses a high risk to users who may unknowingly disclose sensitive information or authorize malicious transactions. Analysis indicates that hlp-lger.zapier.app is flagged by 14 of 95 security vendors on VirusTotal, signaling broad recognition of its malicious intent. The domain resolves to the IP address 64.239.123.65 and is registered through Name.com, Inc. It appears on three distinct security blocklists, further corroborating its fraudulent nature. The page title, "Ledger.com/start® | Begin," directly mimics Ledger’s official onboarding process, a tactic commonly employed to lower user vigilance. Infrastructure analysis reveals the use of Amazon Web Services, Vercel, and Amazon S3 for hosting, alongside Stripe and reCAPTCHA, which are often leveraged to lend an air of legitimacy to phishing pages. The SSL certificate is issued by Let’s Encrypt, a detail that, while standard for many legitimate sites, does not mitigate the domain’s malicious intent. Current evidence confirms that hlp-lger.zapier.app remains operational and continues to pose a significant risk to users. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to prevent access. Users who may have interacted with this domain should immediately revoke any connected wallet authorizations, rotate credentials, and monitor accounts for unauthorized activity. Security teams are encouraged to review logs for connections to 64.239.123.65 and the domain itself, as these serve as concrete indicators of compromise. Proactive measures, such as domain monitoring and user education on recognizing brand impersonation tactics, are recommended to mitigate similar threats in the future.