helps-x-live-eng[.]pages[.]dev

This domain, helps-x-live-eng.pages.dev, is currently active and hosts a page titled “Ledger Login – Fast”, explicitly targeting users of the Ledger brand. The site is delivered through Cloudflare infrastructure, using the nameservers brenda.ns.cloudflare.com and salvador.ns.cloudflare.com and resolving to IP 172.66.44.232, which is geolocated to Cloudflare’s data center in Canada. TLS is provided by Google Trust Services under the WE1 certificate, and the server advertises HSTS and HTTP/3, indicating a modern configuration. The domain was registered on 25 March 2026 via Cloudflare, Inc. VirusTotal reports five of ninety‑four scanners flagging the host, and the domain is listed on one public blocklist. PhishDestroy has already blocked the site, and Gridinsoft assigns it a trust score of zero out of one hundred. The available intelligence confirms a high‑risk brand‑impersonation campaign, but the actual page content and any credential‑ harvesting mechanisms have not been publicly disclosed. Defenders should add the fully qualified domain to DNS‑based blocklists, enforce URL filtering for any Ledger‑related login attempts, and monitor for similar Cloudflare‑hosted domains created after March 2026 that present Ledger‑related titles. Continuous scanning of the site for malware or credential‑stealing scripts is recommended to capture any evolving threats.