secure-ledger-blog[.]created[.]app

Analysis indicates that the domain secure-ledger-blog.created.app, registered through Tucows Domains Inc. on July 12, 2023, is being used to impersonate Ledger's official wallet offering. The sole page indexed presents the title “Download and install Ledger Wallet™ (formerly Ledger Live)”, a clear indicator of brand impersonation aimed at crypto users. The site is hosted on infrastructure supplied by Amazon Web Services (AS16509) and delivered through Google Cloud CDN and Vercel, as reflected by the presence of Google Cloud, Vercel, LaunchDarkly, and HSTS headers. DNS resolution points to IP 216.150.16.193 in the United States, and the domain resolves to the nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, consistent with the Vercel hosting model. The site employed a Let’s Encrypt R13 TLS certificate, which confirms the presence of HTTPS but does not provide any assurance of legitimacy.

Observational data shows that the domain appears on a single security blocklist and is actively listed by PhishDestroy. VirusTotal scans have returned positive detections from 15 of 95 scanned security vendors, reinforcing the suspicion of malicious intent. Google Safe Browsing has classified the domain under the “social engineering” category, aligning with the observed brand‑spoofing behavior. The page currently returns an HTTP 404 status and the infrastructure has been taken offline, limiting immediate threat exposure but leaving the potential for re‑activation. Uncertainty remains regarding the full scope of the campaign, including whether additional malicious payloads or credential‑harvesting pages were previously hosted, as the current HTTP 404 response prevents content retrieval.

No further evidence of downloader kits, command‑and‑control servers, or victim interaction is available from the provided data.