start-ledgrcom-eng-c1w[.]pages[.]dev

PhishDestroy identifies start-ledgrcom-eng-c1w.pages.dev as an active Ledger wallet phishing domain, leveraging a spoofed 'start-ledger.com' subdomain to deceive users into entering recovery phrases. The threat type is browser-in-the-middle phishing, utilizing a decoy interface to harvest sensitive cryptocurrency wallet credentials. No known drainer kit signatures were detected in this campaign, but the infrastructure mirrors previous Ledger-themed phishing operations observed in Q2 2024. This domain resolves to IP 172.66.46.230 and was registered through Cloudflare, Inc., with a Google Trust Services SSL certificate issued for phishing mitigation obfuscation. VirusTotal shows a detection rate of 2 out of 95 security vendors, and the domain remains unlisted on Google Safe Browsing (GSB) as of real-time checks. Historical WHOIS data indicates a recent creation date, though Cloudflare’s WHOIS privacy masking limits definitive age attribution. The domain is currently active and hosting a fraudulent Ledger wallet login interface. PhishDestroy recommends immediate blocking at the network and endpoint levels using the IP and domain indicators. While the current risk remains elevated due to active campaign operation, proactive takedown requests have been escalated to Cloudflare. Users are advised to verify destination domains before entering credentials and enable hardware wallet authentication where possible.