eng--ledgeir[.]pages[.]dev

Analysis of eng--ledgeir.pages.dev indicates this domain was actively impersonating Ledger, a hardware cryptocurrency wallet provider, as recently as July 2026. The domain was registered on March 23, 2026, through Cloudflare, Inc., and resolved to IP address 172.66.44.182, hosted in Canada under Cloudflare’s infrastructure. The page title explicitly claimed affiliation with Ledger, presenting itself as 'Ledger Live (Official) — Secure Bitcoin,' a direct mimicry of the legitimate Ledger Live application. This aligns with the classified scam type: crypto scam, as noted in available threat intelligence. Infrastructure analysis reveals the domain was secured with an SSL certificate issued by Google Trust Services (WE1), a common practice among both legitimate and fraudulent sites to appear trustworthy.

The domain employed HTTP Strict Transport Security (HSTS) and HTTP/3, technologies that enhance security but are also adopted by threat actors to evade detection. At the time of assessment, the domain returned an HTTP 403 status, indicating access was forbidden, which may suggest recent takedown efforts or backend restrictions. Detection data from security vendors shows 14 of 94 engines on VirusTotal flagged the domain as malicious, providing concrete evidence of its suspicious nature. Additionally, the domain appears on at least one security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, further corroborating its classification as a high-risk domain.

Nameservers were hosted under Cloudflare (april.ns.cloudflare.com and trace.ns.cloudflare.com), a common hosting provider for both legitimate and malicious sites. While the domain is currently offline, defenders should treat any prior or future activity associated with this infrastructure as highly suspicious.