0/100

low Risk

shop-ledger.at

https://shop-ledger.at

172.67.142.44 · Cloudflare, Inc.

Location

Toronto, Canada

Domain Age

—

HTTP

200 · 14.0s

SSL

Valid· WE1, Google Trust Services, US

Status

COMPLETED

Visual Evidence

Zoom

Title: "VaultKey — Hardware Crypto Wallet"

Save

Linked Phishing Report

This scan is attached to a vendor submission report

Brand

VaultKey / VaultKey

Vendors

30/31

Status

partial

✗ norton✓ sophos✓ polyswarm✓ netcraft✓ apwg✓ spamhaus✓ eset✓ virustotal✓ kaspersky✓ microsoft✓ brightcloud✓ avg✓ bitdefender✓ avast✓ chainpatrol✓ apple✓ cisa✓ phishreport✓ yandex✓ drweb✓ urlquery✓ emsisoft✓ urlscan✓ isitphish✓ phishtank✓ openphish✓ urlabuse✓ threatyeti✓ mcafee✓ google✓ fortiguard

KB/IOK Matches (0)—

No KB/IOK detections were recorded for this scan.

Shop-ledger.at

Unknown

technology | finance · 7/19/2026

Summary

The page displays VaultKey branding with a Ledger-related domain name (shop-ledger) suggesting impersonation signals. The page title and content reference VaultKey hardware wallet, while the domain name contains 'ledger', a known brand, raising impersonation concerns. However, there is no concrete evidence of credential collection or malware delivery in the static HTML; the SPA behavior and dynamic scripts mean credentials could be captured in runtime. SSL is valid and the page serves content, but the domain intelligence indicates potential brand impersonation rather than a first-party VaultKey site.

Evidence Summary

▸Observed 2 capture stage(s); canonical stage is settled_render.

▸POST targets observed during capture: https://shop-ledger.at/cdn-cgi/rum?.

▸Distinctive asset clues: v833ccba57c9e4d2798f2e76cebdd09a11778172276447, css2.

Capture

Stages: 2

Canonical: Settled Render

Changed: No

Credential Signals

Forms: 0

Password fields: 0

Late-stage login UI: No

Resource Signals

Resources: 7

Hosts: 4

Domains: 4

Observed Signals (2)

Domain similarity / brand impersonation signals (domain contains 'ledger' while branding shows VaultKey).SPA-style page rendering with dynamic credential capture risk (static HTML contains no forms).

Observed Indicators (0)

No suspicious indicators identified

Risk AssessmentUsed in abuse reports

The scan indicates potential brand impersonation due to the domain name containing Ledger while displaying VaultKey branding, which is a strong signal for impersonation/phishing risk. There is no direct evidence of credential collection in the static HTML; however, the SPA rendering means forms could be injected at runtime via JavaScript. Given the branding mismatch and presence on a presumably separate domain, this warrants cautious handling and further provenance checks. The page appears to be accessible and legitimate-looking but not conclusively first-party VaultKey content.

Recommended Action

Monitor

Cross-Reference9

URL Intelligence