support-ledger-com[.]vercel[.]app

This domain, support-ledger-com.vercel.app, is flagged as a brand-impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to mimic legitimate Ledger support pages, likely to harvest user credentials, recovery phrases, or facilitate unauthorized transactions. The domain exhibits characteristics consistent with phishing infrastructure, including the use of a subdomain under vercel.app, a platform commonly exploited for rapid deployment of fraudulent sites. No specific drainer kit signatures were identified in the available data, but the targeting of cryptocurrency users aligns with common tactics observed in credential theft and wallet-draining campaigns. Infrastructure analysis reveals multiple technical indicators corroborating the malicious classification. The domain resolves to IP address 216.198.79.195, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. It was registered through Tucows Domains Inc. on February 21, 2026, an anomalous creation date suggesting potential domain spoofing or typosquatting. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider, which is often leveraged by threat actors to lend credibility to fraudulent sites. The domain appears on two security blocklists, PhishDestroy and PhishingDB, and is flagged by 17 out of 95 security vendors on VirusTotal, with detections including phishing, brand impersonation, and malicious site classifications. The page title, 'Deployment Unavailable,' may indicate a temporary takedown or staging phase, common in phishing operations. As of the latest assessment, support-ledger-com.vercel.app has been taken offline, reducing immediate exposure to end users. However, the domain remains registered and could be reactivated or repurposed for future campaigns. The elevated risk level is justified by the combination of brand impersonation, cryptocurrency targeting, and prior detection by multiple security mechanisms. Users who may have interacted with this domain are advised to immediately revoke any connected wallet permissions, rotate credentials for associated accounts, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its resolving IP, while remaining vigilant for similar subdomain-based impersonation attempts under legitimate hosting platforms. The creation date discrepancy warrants further investigation into potential domain registration abuse or compromised accounts.