en-legar-com[.]pages[.]dev

Analysis of the domain en-legar-com.pages.dev indicates active brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on April 27, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.253, associated with Cloudflare’s infrastructure in Canada. The domain’s nameservers, daisy.ns.cloudflare.com and devin.ns.cloudflare.com, further confirm its hosting on Cloudflare’s platform, which is commonly leveraged by threat actors to obscure origin servers and evade takedowns. The page title, 'Get Started with Ledger | Secure Your Crypto Wallet,' explicitly aligns with Ledger’s branding, suggesting an intent to deceive users into believing the site is an official Ledger resource. As of July 12, 2026, the domain remains active and returns an HTTP 200 status, indicating operational status. It is flagged by one security blocklist, PhishDestroy, and has been detected by 11 of 91 security vendors on VirusTotal, though the specific nature of these detections remains unverified in this analysis. Infrastructure analysis reveals the use of Cloudflare’s HTTP/3 and HSTS technologies, which may enhance the site’s perceived legitimacy while complicating forensic investigation. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority that does not inherently indicate malicious intent. Gridinsoft assigns the domain a trust score of 0/100, reinforcing its classification as high-risk. Defenders are advised to treat this domain as a confirmed phishing resource impersonating Ledger. Network-level blocking of the IP 172.66.44.253 and the domain itself is recommended. Organizations should monitor for user interactions with this domain, particularly in contexts involving cryptocurrency transactions or wallet setup instructions. Further investigation into the site’s backend infrastructure and any associated wallet addresses is warranted to assess the full scope of the campaign.