crypt-ledger-live-login[.]vercel[.]app

Analysis of crypt-ledger-live-login.vercel.app confirms it as a high-risk phishing domain targeting Ledger users, operational from December 1, 2025, until its takedown. The domain was registered through Vercel Inc. and hosted on Vercel’s infrastructure, resolving to IP 216.198.79.195 within Amazon.com, Inc.’s AS16509 network in the United States. The SSL certificate, issued by Google Trust Services (WR1), and the presence of HSTS headers suggest an attempt to appear legitimate, though these measures are commonly exploited in phishing campaigns. The page title, 'Ledger® Live Login® (en-US) | Ledger Support,' directly impersonates Ledger’s official branding, aligning with the scam type classified as a crypto scam. Detection systems flagged the domain aggressively: Google Safe Browsing labeled it as social engineering, and PhishDestroy blocked it.

Scamadviser assigned a trust score of 1/100, reinforcing its malicious classification. As of the report date, the domain appears on at least one security blocklist, and VirusTotal records 20 detections from 95 security vendors, indicating broad consensus on its fraudulent nature. The HTTP status code 451, typically indicating legal takedown, suggests the domain was removed due to its illicit activity. Infrastructure analysis reveals no valid nameservers (NS_NOT_FOUND), a common artifact of rapid domain deployment and abandonment in phishing operations. The use of Vercel’s platform for hosting is notable, as it provides free, disposable subdomains that complicate attribution and takedown efforts.

While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, detection counts, and hosting patterns confirms its role in a crypto-focused credential harvesting campaign. Defenders should treat this domain as confirmed malicious. Network-level blocks should be implemented for the IP 216.198.79.