legder[.]com[.]es

PhishDestroy first observed legder.com.es on Oct 6, 2025. Stored content metadata identifies Ledger as the apparent target. The captured page title is “api.www.legder.com.es”. Stored page analysis classifies the content as wallet/seed phishing. Current evidence score: 89/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and DNS security resolvers. VirusTotal recorded 13 detections among 95 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Lionic, Seclookup, Sophos, VIPRE, Webroot on Jul 18, 2026 at 18:45 UTC. DNS security checks returned 3 blocking results across 14 tested policies: Control D Adblock, Control D Family, Control D Malware; no observation timestamp was retained. Non-positive and contextual checks: AlienVault OTX listed 2 community pulse references (not vendor detections) on Mar 1, 2026 at 20:51 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:24 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:58 UTC.

The collector marked the hostname reachable on Aug 7, 2026 at 22:14 UTC, but did not retain the HTTP response code. Registration records for the domain list BNL-77 (ASN: 399629) as the registrar. At collection time, the hostname resolved to 69.67.173.29 on AS399629 (BL Networks). The recorded endpoint location is Bucharest, RO. DOM analysis on May 9, 2026 at 07:20 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 2 visual captures from PhishDestroy and URLScan.

The content indicators and 2 positive source findings support the current Ledger-themed wallet/seed phishing classification.