eng-ledgei-r[.]pages[.]dev

The domain eng-ledgei-r.pages.dev has been identified as a brand impersonation threat specifically targeting Ledger, a popular cryptocurrency hardware wallet provider. This domain was designed to deceive users into believing they are accessing the official Ledger Live platform, as evidenced by its page title, "Ledger Live (Official) — Secure Bitcoin." Fortunately, the domain is currently offline, but the threat it posed was significant. PhishDestroy classifies this as an elevated risk due to its explicit impersonation of a trusted brand and its aim to harvest sensitive information or credentials from unsuspecting users.

Technical indicators reveal that eng-ledgei-r.pages.dev is flagged by 3 out of 95 security vendors on VirusTotal, placing it in a moderately suspicious category. The domain was registered through Cloudflare, Inc. and created on September 22, 2025, making it relatively recent at the time of analysis. It resolves to the IP address 188.114.97.3, which is associated with Cloudflare's infrastructure. Additionally, the domain appears on one security blocklist, further corroborating its malicious intent. While the trust scores from various sources are not explicitly provided, the combination of these factors underscores the domain's deceptive nature.

Given that the domain is currently offline, the immediate risk to users is mitigated. However, PhishDestroy strongly recommends that users who may have interacted with eng-ledgei-r.pages.dev take proactive measures. If any credentials or private keys were entered, they should be changed immediately and funds moved to a secure wallet. Users should always verify the legitimacy of any Ledger-related website by navigating directly to the official Ledger Live URL or using the official desktop application. PhishDestroy continues to monitor such threats and advises all users to remain vigilant against domain impersonation attacks, especially those targeting cryptocurrency platforms.