engs-ledgerf[.]pages[.]dev

engs-ledgerf.pages.dev is flagged as a brand‑impersonation site targeting Ledger users. The domain was registered on March 22 2026 through Cloudflare, Inc., and uses Cloudflare’s DNS infrastructure (sharon.ns.cloudflare.com, terin.ns.cloudflare.com). DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare’s network in Canada. The web server returns HTTP 403, and the site presents the page title “Ledger Live — Secure Crypto Wallet”, directly referencing Ledger’s official product line. The SSL certificate is issued by Google Trust Services under the WE1 root, confirming that TLS is correctly configured and that HSTS, Cloudflare and HTTP/3 are advertised.

Security‑vendor scans on VirusTotal show 14 of 94 engines flagging the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100, indicating a high confidence of abuse. The domain appears on at least one public blocklist and is actively blocked by PhishDestroy. The listed scam type is “Crypto Scam”, and the site is categorized as impersonating Ledger. Current operational status is offline, which may be due to takedown actions or temporary hosting changes. The available evidence confirms that the infrastructure is typical of cloud‑based phishing deployments: a recent registration, use of a reputable CDN, and a valid TLS certificate that can lend credibility to the malicious page.

No additional payload, dropper, or credential‑harvesting details have been disclosed, so the exact phishing vector remains unknown. Defenders should continue to enforce blocklist updates for the domain and its associated IP, monitor for any re‑registration or similar sub‑domains under the same Cloudflare account, and ensure that endpoint protection solutions are tuned to the 14 VirusTotal detections. Network traffic to 188.114.97.3 should be inspected for anomalous HTTP 403 responses that may indicate attempts to access the impersonated Ledger page.