Ledger Phishing - BIP-39 wordlist fetch from Vercel-hosted phishing endpoint
Detects a multi-stage phishing attack targeting cryptocurrency users, specifically Ledger wallet holders. The detection identifies an initial request to a Vercel-hosted domain for a BIP-39 wordlist (a common recovery phrase standard) followed by a POST request to a similar Vercel-hosted endpoint, suggesting the exfiltration of a secret recovery phrase.
Suricata
