shop-ledger[.]at

This domain, shop-ledger.at, is flagged as a high-risk brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. The site presents itself as "VaultKey — Hardware Crypto Wallet," a likely attempt to deceive users into believing it is an official or affiliated service. No direct evidence of a crypto drainer kit is observed, but the impersonation tactic aligns with common phishing campaigns aimed at credential harvesting or fraudulent transactions. The domain exhibits characteristics typical of phishing infrastructure, including misleading branding and a deceptive page title designed to exploit trust in the targeted brand. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to the IP address 158.94.209.135 and is hosted on an Nginx server. The SSL certificate is issued by Google Trust Services, a detail that may lend a false sense of legitimacy. Detection metrics indicate that 18 out of 95 security vendors on VirusTotal flag the domain as malicious. Additionally, the domain appears on four security blocklists and is actively blocked by multiple security tools, including MetaMask and SEAL. The Gridinsoft trust score for this domain is 0 out of 100, further corroborating its malicious classification. As of the latest assessment, shop-ledger.at has been taken offline, likely in response to detection and reporting by security vendors. However, the risk of re-emergence or migration to a newly registered domain remains high, particularly given the financial incentives associated with cryptocurrency-related phishing. Users who may have interacted with this domain are advised to verify wallet integrity, revoke any suspicious connected applications, and monitor for unauthorized transactions. Organizations are recommended to update blocklists and educate users on recognizing brand impersonation tactics in cryptocurrency-related communications.