sta-rt-ledgr[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Ledger wallet users. Analysis indicates the site mimics the official Ledger.com/Start onboarding portal, designed to harvest recovery phrases, private keys, or wallet credentials from unsuspecting users attempting to initialize hardware wallets. Infrastructure analysis reveals the domain sta-rt-ledgr.pages.dev was registered on March 23, 2026, through Cloudflare, Inc. It resolves to IP address 188.114.97.3, hosted in Canada under Cloudflare infrastructure. The SSL certificate is issued by Google Trust Services (WE1). VirusTotal detection shows 17 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and remains active at the time of assessment. The page title explicitly claims legitimacy with "Official Site® | Ledger.com/Start® | Getting started with handing," containing typographical errors indicative of fraudulent intent. Mitigation requires immediate blocking of sta-rt-ledgr.pages.dev at DNS and proxy levels. Network administrators should add the domain and IP 188.114.97.3 to deny lists. End users must verify domain authenticity by cross-checking with official Ledger communication channels before entering sensitive information. Security teams should monitor for connections to this domain or IP in logs, particularly from systems handling cryptocurrency transactions. Ledger users who may have interacted with this domain should regenerate wallet seeds and review transaction histories for unauthorized activity.