ledgeer-com-start-eng[.]pages[.]dev

The domain ledgeer-com-start-eng.pages.dev was registered on August 28, 2025 through Cloudflare, Inc. and is currently delegated to the Cloudflare name servers ajay.ns.cloudflare.com and paloma.ns.cloudflare.com. DNS resolution points to IP address 172.66.46.224, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 label, indicating a valid TLS handshake. The page title returned by the server is "Ledger Live — Secure Hardware Wallet Setup," matching the brand target Ledger and the declared scam type of a crypto‑related impersonation. Risk rating is high and the domain remains active. VirusTotal analysis shows eight of ninety‑three scanners flagging the host, and the domain appears on a single security blocklist. It has also been listed by PhishDestroy as a blocked indicator. Infrastructure evidence suggests the operator is leveraging legitimate cloud services to host a credential‑harvesting or crypto‑drain page that pretends to be associated with Ledger. No public evidence of the page’s internal content has been captured, so the exact phishing vector (e.g., login form, malicious binary) cannot be confirmed. Defenders should block DNS resolution to 172.66.46.224 for this fully qualified domain name, add the domain to URL filtering policies, and monitor outbound traffic for connections to Cloudflare‑hosted IPs that were not previously authorized. Continuous re‑scanning on multi‑engine platforms is recommended to detect any change in the detection count, and incident response teams should treat any credential or wallet seed submissions to this domain as compromised.