auth-ledger-com-strt[.]pages[.]dev

The domain auth-ledger-com-strt.pages.dev is actively impersonating Ledger, a well-known cryptocurrency hardware wallet provider. Detected on its creation date, April 4, 2026, this domain has already been flagged by 9 out of 94 vendors on VirusTotal. It is hosted by Cloudflare, Inc., with an IP address located in Canada.

This phishing domain is designed to deceive users into believing they are interacting with the genuine Ledger site, likely to steal sensitive information such as recovery phrases or account credentials. The page title, 'Get Started with Ledger,' aims to lure users into a false sense of security, mimicking the onboarding process of the legitimate brand.

Despite being newly created, the domain's presence on public blocklists, including PhishDestroy's, highlights its risk. The platform risk score of 83 out of 100 underscores the threat level, indicating a sophisticated attempt to exploit Ledger's brand trust. The SSL certificate, issued by Google Trust Services, adds a layer of legitimacy, potentially deceiving even cautious users. This case exemplifies the importance of early detection in mitigating phishing threats before they propagate widely.