asklogin-leadzeers[.]wasmer[.]app

This domain, asklogin-leadzeers.wasmer.app, poses a direct threat to cryptocurrency wallet users by impersonating Ledger, a hardware wallet provider. The site presents a fraudulent login interface titled 'Ledger Login – Access and Securely Manage Your Crypto,' designed to harvest user credentials. Analysis indicates the domain is structured to mimic legitimate Ledger authentication portals, increasing the likelihood of successful credential theft from unsuspecting victims attempting to access their crypto assets. Evidence supporting the malicious nature of this domain includes detection by 14 out of 95 security vendors on VirusTotal, with a specific classification as brand impersonation. The domain appears on one security blocklist and is currently offline, though prior activity remains a concern. Infrastructure analysis reveals the domain resolves to the IPv6 address 2001:bc8:701:70a:d604:e6ff:fed8:fdc0 and was registered through Squarespace Domains II LLC. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to fraudulent sites. Users who visited asklogin-leadzeers.wasmer.app should immediately revoke any entered credentials and monitor their Ledger accounts for unauthorized access. If login details were submitted, affected parties must transfer assets to a new wallet and enable multi-factor authentication on all associated accounts. Additionally, users should review connected applications and revoke permissions for any suspicious third-party services linked to their Ledger account. Given the domain's elevated risk level, organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.