eng-ledagr-live-web[.]pages[.]dev

PhishDestroy identifies eng-ledagr-live-web.pages.dev as an active Ledger wallet phishing domain targeting cryptocurrency users with fraudulent login pages.

This domain was flagged by 11 of 95 VirusTotal security vendors as of the latest scan, indicating a low initial detection rate despite clear phishing indicators. The domain was registered through Cloudflare, Inc., resolves to IP address 188.114.96.3, and holds a Google Trust Services SSL certificate. Additional telemetry shows this infrastructure has no recorded blocklist entries, suggesting it may be newly deployed or deliberately evading detection. The absence of VirusTotal detections, combined with Cloudflare’s anonymized registration, creates a deceptive appearance of legitimacy.

While the current investigation status remains under active review, the combination of Ledger wallet impersonation, zero VirusTotal detections, Cloudflare registration, and newly assigned infrastructure poses a significant risk to users entering cryptocurrency credentials. The domain’s SSL certificate from Google Trust Services further enhances its credibility to unsuspecting visitors. Immediate action is required to prevent credential theft and potential fund loss. Users who accessed this domain should assume exposure of private keys or seed phrases and initiate a full wallet recovery process using official Ledger tools. Security teams are advised to block 188.114.96.3 at the network perimeter and monitor DNS resolutions for related subdomains. All cryptocurrency users should verify website authenticity via Ledger’s official domain (ledger.com) before entering sensitive information.