ledgerapp[.]created[.]app

This domain, ledgerapp.created.app, is a confirmed brand impersonation threat targeting Ledger, a hardware wallet manufacturer. The infrastructure is designed to mimic legitimate Ledger services, likely to harvest cryptocurrency wallet credentials, recovery phrases, or personal information from unsuspecting users. Analysis indicates the domain was crafted to exploit trust in the Ledger brand, potentially leading to financial loss or unauthorized access to digital assets. Evidence supporting this assessment includes detection by 11 out of 95 security vendors on VirusTotal, registration through Tucows Domains Inc. on July 12, 2023, and presence on five security blocklists. The domain resolved to the IP address 216.150.16.129, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The SSL certificate was issued by Let's Encrypt (R13), a common tactic to lend false legitimacy to phishing sites. The page title, 'Homepage,' further suggests an attempt to replicate a generic yet convincing interface. Users who visited ledgerapp.created.app should immediately revoke any permissions granted to the site in wallet applications or browser extensions. If credentials or recovery phrases were entered, affected users must transfer assets to a new wallet and monitor for unauthorized transactions. Devices used to access the domain should undergo a security scan to detect potential malware. Given the domain's current offline status, no further interaction is possible, but vigilance is advised for similar threats using comparable infrastructure or naming patterns.