ledgestartio[.]created[.]app

The domain ledgestartio.created.app has been identified as a credential theft phishing infrastructure. Analysis indicates the site was designed to harvest user login credentials through deceptive login portals. As of the latest assessment, the domain is offline, though prior activity suggests it was actively targeting users before takedown. Infrastructure analysis reveals the domain was registered on July 12, 2023, through Tucows Domains Inc. and resolved to the IP address 198.18.0.176. It appears on one security blocklist and was flagged by 9 of 95 security vendors on VirusTotal. The SSL certificate was issued by Let's Encrypt (R13), and the page title referenced lfaq.d7jyu2dnjykvx.amplifyapp.com, a subdomain likely associated with the phishing kit. No direct brand impersonation was confirmed, but the credential harvesting mechanism aligns with common phishing tactics. The domain is currently offline, though residual risk remains due to potential reuse of the infrastructure. Organizations are advised to monitor for related indicators, including the IP 198.18.0.176 and the subdomain lfaq.d7jyu2dnjykvx.amplifyapp.com. Network defenders should update blocklists to include this domain and its associated indicators. Users who may have interacted with the site should reset credentials and enable multi-factor authentication on affected accounts.