login-ledgger-load-io-frame[.]vercel[.]app

Analysis of login-ledgger-load-io-frame.vercel.app indicates a high‑risk brand‑impersonation campaign targeting Ledger users. The domain was registered through Vercel Inc. on 14 March 2026 and resolves to the Amazon‑owned address 64.29.17.131, ASN AS16509 in the United States. An SSL certificate issued by Google Trust Services (WR1) secures the site, and the server returns HTTP 308 with HSTS enabled, suggesting deliberate effort to mimic a legitimate service. The landing page presents the title “Ledger Live” and leverages common front‑end stacks such as Bootstrap, Vercel hosting, and the Unpkg CDN. VirusTotal records 21 of 95 security vendors flagging the domain, while Scamadviser assigns a trust score of 1 / 100 and Gridinsoft reports 0 / 100. The site appears on a single external blocklist and has been actively blocked by the PhishDestroy service, confirming its malicious intent. Open information gaps remain. The domain’s authoritative name servers could not be resolved, listed as NS_NOT_FOUND, limiting visibility into the underlying DNS infrastructure. Apart from the single blocklist entry, no additional public blocklists currently reference the host, and detection counts are confined to the cited vendors. The campaign remains active as of the report date, and no mitigation history is observable. Defenders should immediately add login‑ledgger‑load‑io‑frame.vercel.app to DNS‑ and URL‑filtering policies, enforce TLS inspection to capture the HTTP 308 redirect, and monitor for similarly structured subdomains hosted on Vercel. Threat‑intel feeds should be updated with the observed IP 64.29.17.131 and the associated ASN, and brand‑monitoring rules should flag any page titles containing “Ledger Live” that are served from non‑official certificates. Continuous observation is advised to detect potential replication of the infrastructure.