wel-learn-start-ledgr-x[.]pages[.]dev

This domain, wel-learn-start-ledgr-x.pages.dev, is flagged as an active brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. The site presents a fraudulent version of the legitimate Ledger Start page, titled 'Ledger Start — Secure Self-Custody Setup,' designed to deceive users into entering sensitive wallet recovery phrases or private keys. No explicit drainer kit signatures have been identified, but the infrastructure aligns with credential harvesting campaigns targeting cryptocurrency users. Infrastructure analysis reveals the domain was registered on April 05, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, geolocated to Canada under Cloudflare’s network. VirusTotal detection indicates 3 out of 95 security vendors have flagged the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns leveraging Cloudflare Pages. As of the latest verification, the domain remains active and unmitigated, posing a high risk to users attempting to set up or recover Ledger wallets. No takedown requests or registrar enforcement actions have been observed. Users are advised to avoid interaction with the domain and verify all Ledger-related communications through official channels. The remaining risk includes potential credential exposure, unauthorized wallet access, and financial asset theft. Continuous monitoring of associated infrastructure is recommended to track further developments.