ldger-com-start-web[.]pages[.]dev

PhishDestroy identifies an active brand impersonation campaign targeting Ledger crypto wallet users through ldger-com-start-web.pages.dev. The domain replicates Ledger's verification portal under the guise of 'Get Started with Ledger - Ledger.com/start,' attempting to harvest sensitive credentials under the pretense of a mandatory wallet setup. This tactic exploits user trust in Ledger's brand to bypass traditional phishing skepticism. The threat remains under investigation as analysts assess the full scope of its infrastructure and potential payload distribution vectors. This domain exhibits numerous red flags consistent with malicious impersonation campaigns. It resolves to IP 172.66.44.202 via Cloudflare's Pages service, leveraging the platform's legitimate infrastructure to obscure its origins. Currently showing 8/95 detections on VirusTotal despite weeks of activity, the domain maintains a clean reputation score while exploiting Google Trust Services' SSL certificate to appear legitimate. The Cloudflare registration through registrar ID 000000000 (Cloudflare, Inc.) provides no useful attribution, while the impersonation of Ledger.com/start—Ledger's actual verification domain—reveals clear malicious intent. No known blocklist entries exist for this domain at present, creating an undetected threat vector. Users must immediately block ldger-com-start-web.pages.dev at DNS/network levels and avoid any crypto wallet verification prompts outside of Ledger's official domains (ledger.com or ledger.com/start). Organizations should update proxy filters with IP 172.66.44.202 and the Cloudflare Pages ASN range. Critical guidance includes verifying all wallet setup URLs directly through Ledger's browser extension or mobile app, never via third-party links. Incident responders should prioritize wildcard blocking for *.pages.dev domains associated with crypto brands while monitoring for similar impersonation patterns. Early intervention remains crucial as this campaign continues evolving without detection system coverage.