lmk-ekl-dzg-gzd-ees-rdc-sfu[.]netlify[.]app

This domain, lmk-ekl-dzg-gzd-ees-rdc-sfu.netlify.app, is identified as a brand impersonation threat targeting Ledger, a well-known cryptocurrency hardware wallet provider. The page title, 'Ledger Live,' mimics the legitimate Ledger Live application interface, likely designed to deceive users into entering sensitive credentials or wallet recovery phrases. Analysis indicates the presence of a crypto drainer kit, which may automatically siphon funds from connected wallets upon user interaction. The domain infrastructure and content closely resemble legitimate Ledger properties, increasing the likelihood of successful social engineering attacks against unsuspecting victims. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 63.176.8.218, hosted on Amazon.com, Inc. (AS16509) infrastructure located in Germany. The domain was created on May 09, 2018, and is registered through Netlify. VirusTotal detection shows 18 out of 95 security vendors flagging this domain as malicious, while it appears on 2 security blocklists. The SSL certificate is issued by DigiCert Inc, specifically under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' chain, which does not align with Ledger’s typical certificate authority patterns. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure remains a residual risk, as threat actors may redeploy similar domains or reuse the hosting environment for future campaigns. Users who interacted with this domain prior to its takedown should assume credential or wallet compromise and take immediate remediation steps, including revoking wallet access, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators to prevent future access attempts.