secure-live-ledger-walletlogin-ch[.]vercel[.]app

This domain, secure-live-ledger-walletlogin-ch.vercel.app, is actively engaged in brand impersonation targeting Ledger, a recognized hardware wallet provider. The threat type is classified as credential theft, specifically designed to harvest cryptocurrency wallet credentials by mimicking legitimate Ledger authentication interfaces. As of the latest verification, the domain remains operational and unmitigated. Analysis indicates the domain was registered on May 08, 2026, through Vercel, a platform commonly exploited for rapid deployment of fraudulent pages. It resolves to the IP address 216.198.79.3, associated with Lefkoff Industries in the United States. The SSL certificate is issued by Google Trust Services under the identifier WR1, which does not inherently validate legitimacy. Security telemetry shows the domain is flagged by 19 of 95 VirusTotal vendors, and it appears on one security blocklist, specifically PhishDestroy. The page title, "Ledger® Hardware Wallet | Secure Your Crypto Assets," directly replicates official Ledger branding to deceive users. The current risk assessment remains high due to the domain's active status and its direct targeting of cryptocurrency users. Infrastructure analysis reveals no legitimate association with Ledger, and the creation date discrepancy suggests potential domain spoofing. Recommended actions include immediate blacklisting of the domain and IP across security gateways, deployment of endpoint detection rules for the domain string, and user education regarding verification of SSL certificates and domain authenticity before entering credentials. Network administrators should monitor for connections to 216.198.79.3 and inspect logs for repeated access attempts to secure-live-ledger-walletlogin-ch.vercel.app.