legder[.]at

The domain legder.at has been identified as a fraudulent site targeting Ledger users by attempting to harvest cryptocurrency wallet seeds. Infrastructure analysis shows the domain resolves to the IP address 198.18.0.6 and is hosted behind Cloudflare nameservers alexandra.ns.cloudflare.com and walt.ns.cloudflare.com. No TLS certificate is presented, indicating the site operates without HTTPS protection. The registrar listed is Hosting Concepts B.V., operating under the brand Registrar.eu. The page title returned from the server is "secure.www.legder.at," which does not match the legitimate Ledger brand and reinforces the impersonation intent.

Threat intelligence sources corroborate the malicious nature: the site appears on one security blocklist, is blocked by PhishDestroy, and has been cited in 17 AlienVault OTX threat‑intelligence pulses. VirusTotal analysis shows that 16 of 95 scanned security vendors flagged the domain, reflecting a consensus of malicious classification. Additional scoring from Gridinsoft assigns a trust rating of 0 out of 100, further confirming the site’s lack of legitimacy. The scam type is explicitly recorded as Wallet/Seed Phishing, and the domain is known to impersonate Ledger.

While the site is currently taken offline, defenders should retain the indicators of compromise—IP address, nameserver configuration, registrar details, and the observed page title—to update internal blocklists and external threat‑sharing feeds. Monitoring for re‑registration of the same name or similar variations is advised, as threat actors often recycle infrastructure. Defensive measures should include DNS sink‑holing of the domain, network‑level blocking of the associated IP, and alerting any endpoint security solutions that reference the observed VirusTotal detections.