io-ledgercom-starts[.]pages[.]dev

This domain is an active brand impersonation site targeting users of a hardware wallet manufacturer. The site mimics the official device initialization process, presenting a fraudulent interface labeled 'Get started with Ledger — Ledger.com/start'. Visitors are prompted to enter sensitive recovery phrases under the guise of device setup, which are then harvested by threat actors for unauthorized access to cryptocurrency wallets. The attack exploits trust in the brand's legitimate onboarding flow, using visual and textual elements nearly identical to the authentic process. Analysis indicates this domain was registered on September 02, 2020, through Cloudflare, Inc. infrastructure. It resolves to the IP address 172.66.44.141, hosted on AS13335, and is flagged by 9 out of 95 security vendors on VirusTotal. The domain appears on three independent security blocklists and is actively blocked by multiple cryptocurrency security platforms. Its SSL certificate is issued by Google Trust Services under the identifier WE1, providing a false sense of security to visitors. The page title precisely replicates the legitimate setup URL, increasing the likelihood of successful deception. If this domain was visited, immediate action is required to mitigate potential compromise. Users should assume any entered recovery phrases or private keys have been exposed and take steps to secure their assets. This includes generating new recovery phrases, transferring funds to new wallet addresses, and monitoring all linked accounts for unauthorized transactions. Devices used to access the site should be scanned for malware, and all saved credentials should be reset. Users should verify future interactions with the legitimate domain through official channels only, avoiding links from emails, search results, or third-party sources. The domain remains active as of this report, and continued vigilance is necessary to prevent further exploitation.