ldger-com-startt[.]pages[.]dev

The domain ldger-com-startt.pages.dev is actively impersonating the cryptocurrency hardware wallet brand Ledger. It has been flagged as malicious by 11 out of 94 vendors on VirusTotal, indicating a significant level of detection and concern. The domain is hosted by Cloudflare, Inc. in Canada, with an SSL certificate issued by Google Trust Services. This setup is designed to deceive users into believing they are interacting with the legitimate Ledger website.

The scam involves a phishing page titled "Get started with Ledger — Ledger.com/start®", which aims to trick users into entering sensitive information under the guise of setting up their Ledger device. The domain was created on April 4, 2026, and was detected by PhishDestroy on the same day, highlighting the rapid identification capabilities of our threat intelligence systems. The platform risk score for this domain is exceptionally high at 93 out of 100, reflecting its potential threat level.

Despite its recent creation, the domain has already made it onto one public blocklist, specifically PhishDestroy's. This underscores the importance of early detection and swift action in the cybersecurity landscape. The use of a reputable registrar and SSL issuer further adds a layer of perceived legitimacy, making it a sophisticated threat that could potentially deceive even vigilant users. The combination of these factors makes ldger-com-startt.pages.dev a critical domain to monitor and block to prevent potential data breaches and financial loss.