ledgt5-kmh7[.]netlify[.]app

The domain ledgt5-kmh7.netlify.app has been assessed as having an elevated risk level due to its specific threat type of brand impersonation, targeting the cryptocurrency hardware wallet brand Ledger. The impersonation is evident from the page title 'Ledger Live,' which mimics the legitimate Ledger Live application used for managing cryptocurrencies and interacting with Ledger hardware wallets.

Infrastructure analysis reveals that this domain resolves to the IP address 63.176.8.218, which is located in Germany and is associated with AS16509 Amazon.com, Inc. The domain is registered through Netlify, a popular web hosting service. The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1, which adds an additional layer of trust but does not authenticate the legitimacy of the domain. The domain appears on two security blocklists, PhishDestroy and PhishingDB, and has been flagged by 20 out of 95 security vendors on VirusTotal. The current status of the domain is offline, indicating that it has been taken down or is no longer active. The exact creation date of the domain is not provided, but the presence on multiple blocklists and the high detection count by security vendors suggest a recent and active malicious campaign.

To mitigate the risks associated with brand impersonation, users are advised to verify the URL of any site claiming to be affiliated with Ledger or offering services related to Ledger Live. Only use official channels and URLs provided by Ledger for downloading the Ledger Live application and managing cryptocurrency transactions. Security teams should monitor for similar domain registrations and block access to such sites to prevent potential phishing attacks. Additionally, implementing domain-based message authentication, reporting, and conformance (DMARC) policies can help in preventing email-based impersonation attacks. Regularly updating security awareness training programs to include examples of brand impersonation tactics will also aid in reducing the likelihood of users falling victim to such threats.