login-ledgger-load-io-subnet[.]vercel[.]app

Analysis of the domain login-ledgger-load-io-subnet.vercel.app indicates active brand impersonation targeting Ledger, a hardware wallet provider. The domain was registered on May 6, 2026, and remains operational as of July 12, 2026. It resolves to IP address 64.29.17.195, hosted on infrastructure associated with Vercel, Inc. in the United States. The page title, "Ledger® Hardware Wallet | Secure Your Crypto Assets," explicitly mimics Ledger’s official branding, aligning with the reported scam type of brand impersonation. Technical indicators reveal a high-risk profile: the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Twelve of ninety-one security vendors on VirusTotal flag the domain as malicious. The site returns an HTTP 308 status code, which may indicate redirection or cloaking behavior. SSL certification is provided by Google Trust Services (WR1), a common certificate authority, though this does not mitigate the domain’s malicious intent. Infrastructure analysis shows the domain was created through Vercel’s platform, a legitimate service frequently abused for hosting phishing pages due to its ease of deployment and free SSL certificates. The Gridinsoft trust score of 0/100 further supports the classification of this domain as malicious. No evidence of a phishing kit or specific payload has been confirmed at this time, and the exact content of the site remains unanalyzed. Defenders should treat this domain as an active threat. Blocking at the DNS or network level is recommended, particularly for organizations handling cryptocurrency or financial assets. Monitoring for related domains using similar naming conventions (e.g., variations of "ledger," "load," or "subnet") may help identify additional impersonation attempts. Given the domain’s persistence and targeting of a high-value brand, continued vigilance is advised.