ledger-cn[.]at

Analysis indicates that ledger-cn.at is an active brand‑impersonation infrastructure targeting users of the Ledger hardware‑wallet product. The domain was registered on 2026‑04‑16 and resolves to the IPv4 address 193.143.1.166, which is geolocated to Russia and associated with the Proton66 OOO entity. The web server returns HTTP 200 and presents a TLS certificate issued by Let’s Encrypt (R12), confirming encrypted connectivity. The page title “Ledger硬件钱包 - 2026年加密货币安全存储解决方案” aligns with the claimed brand, reinforcing the impersonation claim. VirusTotal reports that 16 of 94 scanning engines flag the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on three public blocklists and has been referenced in a single AlienVault OTX pulse. The risk rating is high and the status remains active as of the report date. Current intelligence does not disclose the underlying phishing kit or specific credential‑collection mechanisms, and no visual analysis of the page content is available. Defenders should block or sinkhole the domain, monitor DNS queries for the associated IP address, and incorporate the domain and its IP into threat‑intel feeds. Continuous re‑evaluation is advised to detect any evolution of the infrastructure or emergence of additional indicators.