ledger-delta-wet-woad-five-sigma-dfasf-324324-343244[.]vercel[.]app

Analysis of the domain ledger-delta-wet-woad-five-sigma-dfasf-324324-343244.vercel.app indicates an elevated-risk brand impersonation campaign targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered through Tucows Domains Inc. on February 21, 2026, resolves to IP address 216.198.79.3, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Google Trust Services, with the common name WR1, and the domain employs HTTP Strict Transport Security (HSTS). At the time of analysis on July 24, 2026, the domain returns an HTTP 404 status with the page title '404: NOT_FOUND,' suggesting it may have been taken offline or is in a dormant state.

Detection data from security vendors reveals that 15 of 93 engines on VirusTotal flagged the domain as malicious, though the specific nature of the threat—whether a crypto scam, credential harvester, or other attack vector—remains unconfirmed due to the absence of active page content. The domain appears on at least one security blocklist, and it has been blocked by PhishDestroy. Infrastructure analysis reveals the use of Vercel, a platform commonly leveraged for rapid deployment of phishing pages due to its ease of use and free hosting capabilities. Defenders should treat this domain as part of a broader pattern of Ledger impersonation campaigns, particularly those exploiting subdomain generation on legitimate hosting platforms.

The combination of a newly registered domain, brand-specific naming conventions, and hosting on a reputable but abused platform aligns with tactics observed in crypto-focused phishing operations. While the domain is currently offline, organizations should monitor for re-emergence or similar subdomains under the vercel.app namespace. Indicators such as the resolving IP, registrar details, and SSL certificate issuer may assist in identifying related infrastructure.