startt-ledgre-com[.]pages[.]dev

This domain impersonates the official Ledger wallet initialization portal, specifically targeting users attempting to set up a new Ledger hardware device. The fraudulent page replicates the legitimate Ledger.com/start interface, designed to harvest cryptocurrency recovery seed phrases, private keys, or other sensitive authentication credentials during the setup process. Analysis indicates the domain was crafted to exploit users unfamiliar with Ledger's legitimate onboarding flow, potentially leading to unauthorized access to digital assets and financial loss. Infrastructure analysis reveals the domain startt-ledgre-com.pages.dev was registered on April 04, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. The domain is flagged by 3 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. The page title, 'Get Started with Ledger | Ledger.com/Start,' precisely matches the legitimate Ledger setup page, further enhancing the deception. Users who visited this domain should immediately cease any interaction and avoid entering sensitive information. If credentials or seed phrases were submitted, affected users must transfer any remaining cryptocurrency assets to a new, secure wallet and generate fresh recovery phrases. Monitor financial accounts and wallet addresses for unauthorized transactions. Report the incident to relevant security teams or fraud reporting platforms. Verify all future Ledger-related communications by accessing the official website directly via a trusted bookmark or verified URL, and enable multi-factor authentication where available to mitigate further risk.