eng-ledger-com[.]pages[.]dev

This domain, eng-ledger-com.pages.dev, was observed by security tooling on February 21, 2026 as a newly registered site hosted on Cloudflare’s edge network (AS13335). The domain resolves to IP 188.114.97.3, located in the United States, and uses Cloudflare‑issued DNS with authoritative nameservers amir.ns.cloudflare.com and katelyn.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) secures the connection, and the site advertises HSTS, Cloudflare front‑end services, and HTTP/3 support. The page title returned from the host is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, indicating that the site is currently blocked by Cloudflare. The host has been taken offline and is listed as “taken offline” in the intelligence feed.

Reputation services rate the domain poorly: Scamadviser assigns a trust score of 41 / 100, Gridinsoft a score of 0 / 100, and the domain appears on a single security blocklist. VirusTotal analysis shows that one of ninety‑three scanning engines flagged the domain, and PhishDestroy also blocks it. The threat is classified as a Crypto Scam that impersonates the hardware‑wallet brand Ledger. No further payload or credential‑harvesting page content has been captured, so the exact technique used to lure victims remains unknown. The single vendor detection suggests a potential malicious indicator, but the low detection count means additional verification is advisable.

The presence of a Cloudflare‑protected page titled “Suspected phishing site” is consistent with a takedown response rather than the original malicious landing page. Defenders should continue to block resolution of eng‑ledger‑com.pages.dev at the network perimeter, monitor for any future re‑registration of the sub‑domain, and add the IP address 188.114.97.3 to threat‑intelligence feeds.