ledger-strt[.]pages[.]dev

This domain is flagged for elevated-risk brand impersonation targeting cryptocurrency hardware wallet users. Analysis indicates a deliberate attempt to spoof Ledger, a widely recognized provider of secure crypto storage solutions, through infrastructure mimicking legitimate wallet activation portals. The specific threat involves credential harvesting and cryptocurrency theft via fraudulent wallet initialization workflows, potentially leading to unauthorized asset transfers. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain ledger-strt.pages.dev is registered through Cloudflare, Inc., with a creation date of March 22, 2026, suggesting an unusually forward-dated registration. It resolves to IP address 188.114.97.3 and employs Cloudflare-hosted infrastructure with HSTS and HTTP/3 protocols. Security vendor assessments show 8 out of 95 engines flagging the domain as malicious on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by enterprise-grade threat prevention systems. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Mitigation requires immediate action from both end-users and security teams. Cryptocurrency holders should verify all wallet activation URLs against official Ledger domains, particularly scrutinizing subdomains containing 'start' or 'setup' keywords. Security teams should implement DNS-based blocking for the domain and its associated IP (188.114.97.3), while monitoring for similar Cloudflare Pages-based spoofing attempts. Organizations should also review web proxy logs for connections to ledger-strt.pages.dev and investigate any internal systems that accessed this infrastructure. Given the cryptocurrency focus, wallet providers should implement additional verification steps for users initiating new device setups, particularly when originating from non-standard domains.