site-ledgaer-eng[.]pages[.]dev

This domain, site-ledgaer-eng.pages.dev, is identified as a high-risk phishing site targeting Ledger, a cryptocurrency hardware wallet provider. The threat type is classified as brand_impersonation, specifically mimicking the official Ledger Live interface to deceive users into disclosing sensitive credentials or transferring cryptocurrency assets. The page title, 'Ledger Live — Securely Manage Your Crypto,' directly replicates the legitimate Ledger Live application, increasing the likelihood of successful social engineering attacks against Ledger users. Analysis indicates the domain was registered on April 01, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.121, located in Canada. As of the latest scan, 11 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The domain appears on one security blocklist and utilizes an SSL certificate issued by Google Trust Services (WE1). Despite its recent creation, the infrastructure analysis reveals active hosting on Cloudflare's content delivery network, which is commonly exploited to obscure the true origin of phishing campaigns. The domain remains active and poses a significant risk to users who may inadvertently interact with it. Response actions include immediate blacklisting and monitoring for further malicious activity. Users are advised to verify domain authenticity by cross-referencing with official Ledger communication channels and to avoid entering credentials or private keys on any unverified platform. The remaining risk is elevated due to the domain's active status and the targeted nature of the impersonation, which may lead to financial loss or unauthorized access to cryptocurrency wallets.