en-ledgr-eng[.]pages[.]dev

en-ledgr-eng.pages.dev was observed on July 23, 2026 delivering a brand‑impersonation campaign targeting Ledger users. The domain was created on 21 February 2026 and is hosted behind Cloudflare’s network, resolving to IP address 172.66.44.117 which belongs to AS13335 Cloudflare, Inc., located in the United States. The site was served over HTTPS with a certificate issued by Google Trust Services under the WE1 label, and Cloudflare‑enabled features such as HSTS and HTTP/3 were detected. The HTTP response returned a 403 status code, and the page title presented by the server is "Suspected phishing site | Cloudflare", indicating that the content has been taken offline.

Reputation services show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist, specifically PhishDestroy, which has already listed it as malicious. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal records 12 detections out of 93 scanning engines, confirming a consensus of malicious activity. The registrar information lists Cloudflare, Inc. as the registrant, and the authoritative nameservers are susan.ns.cloudflare.com and patrick.ns.cloudflare.com. The campaign is identified as a crypto‑scam, leveraging Ledger’s brand to solicit credentials or funds.

While the site is currently offline, the observed infrastructure—dedicated Cloudflare configuration, low trust score, and multiple vendor detections—suggests a purpose‑built phishing operation. Defenders should block the domain and its associated IP at network perimeters, monitor for any future re‑registration of similar subdomains, and update endpoint protection rules to flag URLs containing "ledger" or related keywords. Ongoing intelligence collection is advised to capture any redeployment attempts or related command‑and‑control hosts.