en-ledgr-cloud[.]pages[.]dev

This domain is a confirmed phishing site targeting users of Ledger, a hardware cryptocurrency wallet provider. The site mimics the official Ledger setup page (Ledger.com/start), attempting to deceive victims into entering sensitive recovery phrases or private keys. Such credentials, if compromised, grant attackers full access to cryptocurrency wallets, leading to irreversible asset theft. The page title explicitly replicates the legitimate onboarding process, increasing the likelihood of successful social engineering. Analysis indicates the domain was registered on April 30, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3. Despite its recent creation, the site has already been flagged by one security blocklist (PhishDestroy) and assigned a Gridinsoft trust score of 0/100. VirusTotal reports 0 detections out of 95 engines, suggesting the threat is either new or employs evasion techniques. The domain uses Google Trust Services for its SSL certificate and is served via Cloudflare’s infrastructure, which includes HSTS and HTTP/3 protocols. If you visited en-ledgr-cloud.pages.dev and entered any sensitive information, immediately disconnect the affected device from the internet. Do not use the compromised wallet or recovery phrase for any transactions. Generate a new wallet on a secure, offline device and transfer all remaining assets to the new wallet using a trusted computer. Monitor the original wallet for unauthorized transactions and report the incident to the legitimate Ledger support team. Reset any passwords or credentials that may have been exposed during the interaction with the phishing site.