eng-ledger[.]io

Eng-ledger.io is an active malicious domain observed since its registration on July 17 2025. The site serves a wallet/seed phishing campaign targeting users of Ledger hardware wallets, as indicated by the page title “Ledger Live Download – Secure Hardware Wallet Management” and the explicit impersonation of the Ledger brand. The domain is hosted by DDOS‑GUARD LTD (AS57724) in Russia and resolves to IP 95.129.234.23. Network infrastructure is registered through Hosting Concepts B.V. d/b/a Registrar.eu and uses Openprovider name servers ns1.openprovider.nl, ns2.openprovider.be, and ns3.openprovider.eu. HTTPS is provided by a Let’s Encrypt certificate (identifier YE2), confirming that transport encryption is present but does not validate the legitimacy of the content.

Observational data show that the HTTP response returns status 200, indicating the page is reachable and likely serving the intended malicious payload. Reputation services flag the domain as high‑risk: Scamadviser assigns a trust score of 25 / 100, Google Safe Browsing categorises the URL as social engineering, and AlienVault OTX references the domain in one threat pulse. VirusTotal analysis records 16 of 95 security vendors labeling the domain as malicious. Independent blocklists such as PhishDestroy and CryptoFirewall have already listed the domain, and it appears on two additional security blocklists.

While the exact phishing page content has not been captured in this report, the convergence of brand impersonation, wallet/seed phishing classification, and multiple vendor detections provides sufficient evidence of a credential‑ harvesting operation. Defenders should block egress to 95.129.234.23 at the network perimeter, add eng‑ledger.io to DNS sinkhole or deny lists, and monitor for outbound connections to the associated IP range.