authy-ledger[.]at

PhishDestroy first observed authy-ledger.at on Sep 7, 2026. The hostname explicitly references Ledger; stored content metadata identifies the same apparent target. Page analysis recorded additional brand references to Backpack. Current evidence score: 86/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and Spamhaus DBL. VirusTotal recorded 12 detections among 89 engines: alphaMountain.ai, BitDefender, Chong Lua Dao, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Lionic, SOCRadar, VIPRE, Webroot on Sep 7, 2026 at 15:33 UTC. Spamhaus DBL: DBL_PHISH on Sep 7, 2026 at 14:30 UTC. Non-positive and contextual checks: On Sep 7, 2026 at 15:33 UTC, AlienVault OTX listed 5 community pulse references (not vendor detections); Google Safe Browsing returned no flag. The separate external-blocklist snapshot contained no matches on Sep 7, 2026 at 14:20 UTC. URLScan captured the page on Sep 7, 2026 at 13:27 UTC.

The collector marked the hostname reachable on Sep 7, 2026 at 13:27 UTC, but did not retain the HTTP response code. At collection time, the hostname resolved to 188.114.97.3 on AS13335 (Cloudflare, Inc.). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. DOM analysis on Sep 7, 2026 at 14:22 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 2 visual captures from PhishDestroy and URLScan; no page title was retained, so the captures preserve the landing-page appearance. TLS metadata lists Let's Encrypt as the certificate issuer.

The content indicators and 2 positive source findings support the current Ledger impersonation and phishing classification. The target field identifies Ledger, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.