leiv-ldger[.]zapier[.]app

The domain leiv-ldger.zapier.app was identified as a brand impersonation phishing site targeting Ledger, a cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to deceive users into believing they were interacting with legitimate Ledger services, likely to harvest credentials or distribute malicious payloads. The domain is currently offline, though prior activity warrants further scrutiny. Technical indicators reveal the domain was flagged by 12 of 95 security vendors on VirusTotal, indicating broad detection as malicious. It resolved to the IP address 64.239.109.65 and was registered through Name.com, Inc. on June 12, 2026, an anomalous future date suggesting potential domain spoofing or misconfiguration. The domain appeared on one security blocklist and received a trust score of 0/100 from Gridinsoft. Detected technologies included Amazon Web Services, Vercel, Stripe, reCAPTCHA, HSTS, and Amazon S3, which may have been leveraged to lend credibility to the phishing infrastructure. The SSL certificate was issued by Let’s Encrypt, a common tactic to avoid browser security warnings. Infrastructure analysis indicates the domain was hosted on a platform typically used for legitimate automation services, which may have delayed detection. The elevated risk level stems from the combination of brand impersonation, low trust scores, and security vendor detections. Organizations and users are advised to block the domain at the network level, monitor for related indicators of compromise, and verify any communications claiming to originate from Ledger through official channels. End-users should be trained to recognize brand impersonation tactics, particularly those involving cryptocurrency services, and report suspicious domains to relevant security teams for further investigation.