en-ledger[.]com

PhishDestroy first observed en-ledger.com on Sep 4, 2026. The hostname explicitly references Ledger; stored content metadata identifies the same apparent target. Current evidence score: 95/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, MetaMask, SEAL, and Spamhaus DBL. VirusTotal recorded 16 detections among 90 engines: ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Sophos, VIPRE, Webroot on Sep 4, 2026 at 18:23 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Sep 4, 2026 at 18:20 UTC. Spamhaus DBL: DBL_PHISH on Sep 4, 2026 at 18:30 UTC. Non-positive and contextual checks: AlienVault OTX listed 3 community pulse references (not vendor detections) on Sep 4, 2026 at 18:24 UTC. Google Safe Browsing returned no flag on Sep 4, 2026 at 18:23 UTC. A URLScan capture is available, but no capture timestamp was recorded.

No conclusive timestamped HTTP response is stored. At collection time, the hostname resolved to 104.21.1.176 (AS13335 Cloudflare, Inc.). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. The evidence archive retains 1 visual capture from PhishDestroy; no page title was retained, so the captures preserve the landing-page appearance. TLS metadata lists Google Trust Services as the certificate issuer.

The content indicators and 4 positive source findings support the current Ledger impersonation and phishing classification. The target field identifies Ledger, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.