lmk-ekl-dzg-gzd-ees-rdc-wtu[.]netlify[.]app

Analysis of the domain lmk-ekl-dzg-gzd-ees-rdc-wtu.netlify.app indicates it was actively impersonating Ledger, a cryptocurrency hardware wallet provider, as of July 23, 2026. The domain, hosted on Netlify's infrastructure, resolved to the IP address 63.176.8.218, which is geolocated in Germany and associated with Amazon.com, Inc. (AS16509). The page title 'Ledger Live' directly matches the legitimate Ledger wallet management software, confirming the intent to deceive users into believing they were interacting with an official Ledger service. The domain was registered through Netlify and secured with an SSL certificate issued by DigiCert Inc, specifically a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, which may have contributed to its initial appearance of legitimacy.

Infrastructure analysis reveals the domain lacked configured nameservers at the time of assessment, an atypical characteristic that may indicate rapid deployment for malicious purposes. The HTTP status returned a 404 error, suggesting the phishing content was either removed or relocated following detection. Security vendor responses were swift: the domain appeared on two blocklists, including PhishDestroy and ScamSniffer, and was flagged by 16 of 93 security vendors on VirusTotal, confirming its classification as a crypto scam. The combination of brand impersonation, cryptocurrency targeting, and detection by multiple security entities elevates the risk level associated with this domain.

Defenders should note that while the domain is currently offline, similar campaigns may re-emerge using comparable Netlify-hosted subdomains or alternative hosting providers. Monitoring for newly registered Netlify subdomains with randomized strings, particularly those resolving to Amazon-hosted IPs, may aid in early detection of related threats. Organizations should also update blocklists to include this domain and consider retroactive scanning of logs for connections to 63.176.8.218 or the domain itself.