io--ledgre--com[.]webflow[.]io

This domain is flagged for brand impersonation targeting Ledger hardware wallet users. Analysis indicates the site mimics the official Ledger.com/Start onboarding page, likely attempting to harvest recovery phrases or install malicious firmware under the guise of legitimate setup procedures. The threat primarily affects users who recently purchased Ledger devices and are following initial configuration instructions, potentially leading to complete asset compromise if sensitive information is entered. Infrastructure analysis reveals concrete indicators of malicious intent. The domain was created through Webflow on May 02, 2026 and currently resolves to Cloudflare IP 104.18.36.248 in Canada. VirusTotal detection metrics show 21 out of 95 security vendors flagging the domain as malicious, with the page title explicitly replicating the official Ledger.com/Start® | Official branding. SSL certificate analysis indicates Google Trust Services WE1 certificate issuance, while network infrastructure shows Cloudflare hosting with no legitimate association to Ledger's official ASN or IP ranges. Users who visited this domain should immediately take protective measures. First, disconnect any Ledger device connected during the visit and do not enter any recovery phrases. Second, perform a factory reset on the device using official Ledger recovery procedures. Third, scan the computer used to access the site with updated security tools to detect potential malware installed during the session. Users should verify all future Ledger-related communications through official channels only, as this incident may indicate broader targeting of the Ledger user base through similar infrastructure.