us-ledgrcom-stert[.]pages[.]dev

PhishDestroy identifies us-ledgrcom-stert.pages.dev as an active brand impersonation domain designed to deceive cryptocurrency users by mimicking the legitimate Ledger hardware wallet brand. The site promotes itself under a counterfeit title that includes 'Ledger.com/Start'—a phrase commonly associated with genuine Ledger onboarding processes—for the purpose of tricking visitors into connecting wallets or revealing recovery phrases under false pretenses. This is not a generic phishing attempt; it is specifically engineered as a crypto drainer threat, aiming to illicitly extract digital assets from unwitting users.

This domain was flagged by security researchers after analysis revealed multiple red flags. Registered through Cloudflare, Inc., us-ledgrcom-stert.pages.dev resolves to IP address 172.66.47.109 and currently operates under an SSL certificate issued by Google Trust Services. As of the latest check, it remains undetected by VirusTotal with 12 out of 95 security engines flagging it, indicating it has not yet been widely blacklisted despite clear malicious intent. The domain's creation and rapid deployment suggest an opportunistic campaign leveraging Ledger's strong brand recognition in the crypto space.

If you visited this site, do not enter any recovery phrases, private keys, or seed phrases. Disconnect your wallet immediately and revoke any suspicious connections using tools like revoke.cash. Do a full security audit of your browser extensions, clear cached data, and consider resetting device credentials. Report this domain to your browser's safe browsing program and share it with platforms like PhishDestroy to help protect others. Stay vigilant: always verify domain URLs against official Ledger sources at ledger.com before entering sensitive information.