A single spoofed Ledger email, a phishing-tracker pipeline, a vision model that kept us honest and three distinct pieces of attacker infrastructure, two of them still live at time of writing.
The lure
It starts the way these always do. An email, sent 2026-09-01 09:37 UTC, warning of a “customer database breach” and urging the recipient to “verify their recovery phrase.” Anyone who has worked crypto fraud knows the rule: a recovery phrase is never verified online. Ever. The moment a form asks for those 12–24 words, the wallet is gone.
The headers tell the real story:
From: support-ledger@duanneseeley[.]com
Subject: Important Ledger Device Notification
DKIM/SPF: PASS — but only because the phisher owns duanneseeley[.]com
and verified it in their own Amazon SES account
Reply-To: scam.alert.ledger@collector[.]org
Sent via: Amazon SES (outgoing 54.240.8.13)
Target: tr•••••@gmail.com
The SPF/DKIM pass is worth pausing on. Nothing was spoofed in the authenticated sense the attacker simply registered (or hijacked) duanneseeley[.]com, enrolled it in SES, and let Amazon’s reputation vouch for them. Authentication passing ≠ sender legitimate. The Gmail spam folder caught it anyway, because reputation is more than SPF.
Links in the body route through SES’s own click-tracker (jhnblchm[.]r[.]us-east-1[.]awstrack[.]me) to the real payload:
http://cloud-secure-webview[.]s3-website[.]eu-north-1[.]amazonaws[.]com
An S3 website bucket public, HTTP, and serving a 166-byte index.html that does exactly one thing:
<!-- full payload, mirrored 2026-09-04 -->
<html><head>
<meta http-equiv="refresh" content="0;url=https://verify-address[.]es/recovery-support/">
</head><body></body></html>
A redirect to a Cloudflare-fronted “recovery support” page. (The chain apparently rotates: during our collection the same flow pointed at the Azure host below.)
Scaling one email into a campaign
The seed email is one tree. Passive pivots on the payload domains URLScan, urlquery.net, Certificate Transparency, Wayback grew it into a forest: 480 candidate pages, 320 scored, 37 high-confidence at peak, dominated by a family of Ledger Live typosquats on Cloudflare Pages (*.pages[.]dev): ledger-live-faq, auth-ledger-live-sso, doc-ledger-support, portal-ledgrr-loglive, ledger-hardwere--wallet-eng and friends.
Screenshot analysis was the multiplier here. Our pipeline pushes every captured screenshot through a local vision LLM; on this run it processed 74 of 80 captures and re-graded 21 candidates upward to high confidence on visual corroboration alone. It also correctly waved through genuinely benign pages that keyword-only classifiers would have flagged.
One of those vision analyses mattered more than all the others but not in the way we expected. Keep reading.
The screenshot gallery
All pages captured 2026-09-03/04 via passive scanning (URLScan). Captions include the model’s assessment.