eng-ledger-cdn-app[.]pages[.]dev

This domain, eng-ledger-cdn-app.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the infrastructure is designed to mimic legitimate Ledger services, likely to deceive users into entering sensitive credentials, recovery phrases, or installing malicious software. The domain does not appear to be associated with a known drainer kit at this time, but its design and technical indicators strongly suggest intent to harvest cryptocurrency wallet access or deploy malware for asset theft. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on June 08, 2026, and is currently hosted on Cloudflare’s content delivery network. Technical indicators include a VirusTotal detection score of 15/95 security vendors, with Google Safe Browsing explicitly flagging it as a phishing site. The domain appears on one security blocklist, and its creation date is suspiciously recent, aligning with typical phishing campaign timelines. No legitimate association with Ledger’s official infrastructure or DNS records has been identified, further confirming its fraudulent nature. As of the latest assessment, eng-ledger-cdn-app.pages.dev remains active and poses a significant risk to users. The domain has been blocked by at least one security provider, but no takedown or suspension has been enforced by the hosting platform. Users are advised to avoid interaction with this domain entirely, verify all Ledger-related communications through official channels, and employ multi-factor authentication for cryptocurrency transactions. Given the high detection rate and confirmed phishing status, organizations should update blocklists immediately and monitor for related domains leveraging similar naming conventions or Cloudflare Pages infrastructure.