portal-ledger-new[.]pages[.]dev

This domain is flagged for elevated-risk brand impersonation, specifically targeting Ledger, a hardware wallet provider. The threat involves fraudulent replication of the official Ledger setup portal to deceive users into disclosing sensitive credentials or installing malicious software under the guise of wallet initialization procedures. Analysis indicates the domain was designed to exploit trust in the Ledger brand, potentially leading to financial loss or unauthorized access to cryptocurrency assets. Infrastructure analysis reveals the domain portal-ledger-new.pages.dev was registered through Cloudflare, Inc. on March 22, 2026, and resolved to the IP address 172.66.46.237, located in Canada under Cloudflare’s network. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The page title, "Ledger.com/Start - Official Ledger Wallet Setup Guide*," directly mimics the legitimate Ledger onboarding process, and the SSL certificate is issued by Google Trust Services (WE1), a common certificate authority used in both legitimate and malicious domains. Mitigation steps for this threat type include immediate domain blacklisting across corporate and consumer security gateways, particularly for endpoints handling cryptocurrency transactions. Network administrators should block traffic to 172.66.46.237 and monitor for connections to newly registered pages.dev subdomains impersonating financial or cryptocurrency services. Users should be educated to verify domain authenticity by cross-referencing URLs with the official Ledger website and to avoid entering recovery phrases or private keys on any site not directly accessed via the verified ledger.com domain. Security teams should prioritize monitoring for follow-up campaigns leveraging similar naming conventions or Cloudflare-hosted infrastructure.