en-ledger-log-in[.]pages[.]dev

Analysis of the domain en-ledger-log-in.pages.dev indicates that it was registered through Cloudflare on 21 February 2026 and is presently taken offline. The domain resolves to the Cloudflare edge address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site was served over HTTPS with HSTS enabled and used HTTP/3, and the presented certificate was issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain. An HTTP request returned a 403 status code and the page title displayed by the server is “Suspected phishing site | Cloudflare”.

The nameservers listed are guy.ns.cloudflare.com and sloan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. Security telemetry shows that ten of ninety‑three VirusTotal scanners flagged the domain, and it is listed on a single security blocklist. The Gridinsoft trust score is 0 out of 100, and the domain is blocked by the PhishDestroy service. The threat classification in the intelligence set is a brand‑impersonation crypto scam targeting Ledger users.

No additional content analysis is available because the site is offline, so the exact phishing page layout or credential‑capture mechanisms cannot be confirmed. Defenders should continue to block the IP address 188.114.96.3 and the domain en-ledger-log-in.pages.dev at DNS or proxy layers, monitor for any re‑registration of the same sub‑domain pattern, and update endpoint protection signatures with the VirusTotal detection identifiers. Given the low trust score, the presence on a blocklist, and the confirmed brand‑impersonation intent, the infrastructure should be treated as malicious and excluded from trusted traffic lists.