ldgr-io-strt-acc[.]pages[.]dev

This domain, ldgr-io-strt-acc.pages.dev, is identified as a credential harvesting site specializing in brand impersonation of Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site presents a fraudulent interface titled 'Get Started with Ledger® | Secure Your Crypto Wallet Today,' designed to deceive users into entering sensitive wallet credentials, including recovery phrases and private keys. The threat type is classified as brand impersonation with elevated risk due to its direct targeting of cryptocurrency users and potential for financial asset compromise. Technical indicators confirm the domain's malicious nature. It was registered on March 23, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.167, geolocated to Cloudflare infrastructure in Canada. Detection metrics reveal a VirusTotal score of 10/95, with security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently associated with an SSL certificate issued by Google Trust Services (WE1). Infrastructure analysis reveals the use of Cloudflare Pages, a common tactic to evade detection and leverage legitimate CDN services for malicious purposes. As of the latest assessment, ldgr-io-strt-acc.pages.dev has been taken offline, likely in response to security vendor reports and blocklist inclusion. However, the risk of reemergence remains elevated due to the domain's recent creation date and the persistent threat posed by credential harvesting campaigns targeting cryptocurrency users. Users are advised to verify domain authenticity through official Ledger channels and employ hardware-based multi-factor authentication for wallet access. Security teams should monitor for similar domains leveraging Cloudflare Pages infrastructure and impersonating cryptocurrency brands, as this tactic continues to proliferate in phishing campaigns.