live-ledge[.]created[.]app

Analysis of live-ledge.created.app, observed on July 24, 2026, indicates a credential‑harvesting infrastructure targeting Ledger users. The domain was created on July 12, 2023 and is currently taken offline. DNS resolution points to IP 216.150.1.129, which belongs to Amazon.com, Inc. (AS16509) and is hosted in the United States. The authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, confirming deployment on the Vercel platform.

Vercel‑specific headers and HTTP Strict Transport Security (HSTS) are present, and the site served a Let's Encrypt certificate (R13) before returning a 404 status code. Registration data shows the domain was purchased through Tucows Domains Inc., a common registrar for malicious actors. VirusTotal scans recorded six detections out of ninety‑five antivirus engines, and the domain appears on a single external blocklist, where it has been flagged by PhishDestroy. The page title, “Ledger Live – Manage, Send, and Receive Cryptocurrencies Safely,” aligns with the advertised Ledger brand, confirming a brand‑impersonation attempt.

No additional page content has been captured, leaving the exact phishing payload unknown. Defenders should block the domain at DNS and network layers, monitor for connections to the identified IP address, and add the domain to internal blocklists. Continuous observation of Vercel‑hosted assets and rapid revocation of any compromised credentials associated with Ledger services are recommended. The limited detection footprint suggests the campaign may be in a dormant phase, but the infrastructure remains viable for future activation.