eng-bridge-trizo-en[.]pages[.]dev

This domain, eng-bridge-trizo-en.pages.dev, is actively engaged in brand_impersonation targeting Ledger, a manufacturer of cryptocurrency hardware wallets. The site presents itself as a legitimate Ledger service portal, using the page title 'Ledger® || Secure Web3 Access for Your Ledger Device™' to deceive users into believing they are interacting with official infrastructure. As of the latest verification, the domain remains operational and has not been taken down by its registrar or hosting provider. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 28, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, which is geolocated in Canada and associated with Cloudflare’s network. Only 1 of 95 security vendors on VirusTotal currently flags this domain as malicious. The SSL certificate is issued by Google Trust Services under the WE1 intermediate authority. The domain appears on one security blocklist, specifically PhishDestroy, indicating prior detection by at least one threat intelligence feed. The risk posed by this domain is assessed as high due to its direct targeting of cryptocurrency users, who may be tricked into entering sensitive credentials or recovery phrases under the pretense of secure Web3 access. The use of Cloudflare’s infrastructure and a valid SSL certificate increases the perceived legitimacy of the site, potentially lowering user vigilance. Organizations and individuals are advised to block the domain at the network level and add it to endpoint protection denylists. Users who may have interacted with this domain should immediately revoke any associated wallet permissions, transfer assets to a new secure wallet, and monitor for unauthorized transactions. Security teams should treat this domain as part of a broader phishing campaign and investigate for related infrastructure using the seed identifier '03e060'.