start-ledgrr-eng[.]pages[.]dev

PhishDestroy identifies start-ledgrr-eng.pages.dev as an active brand impersonation domain targeting Ledger users through a fraudulent page titled 'Get started with Ledger — Ledger.com/start®'. This domain employs a spoofed page layout mimicking Ledger's official setup process, likely designed to harvest user credentials or seed phrases under the guise of initializing a hardware wallet. No drainer kit is publicly documented, but the page structure suggests typical phishing tactics aimed at cryptocurrency users.

This domain was flagged with a VirusTotal detection score of 7/95 as of the latest scan, indicating it has not yet been flagged by most antivirus engines. It is registered through Cloudflare, Inc., resolving to IP address 188.114.96.3 and secured with a Google Trust Services SSL certificate. The page was created recently and remains active, with no confirmed blocklist presence at the time of analysis.

The domain is currently active and poses a high risk due to its precise impersonation of Ledger's official setup page. PhishDestroy recommends immediate blocking of this domain and avoidance of any interaction. Users who accessed this page should verify their Ledger device authenticity through official channels and consider revoking any exposed credentials. The risk level remains under investigation but is assessed as high due to the active deception and lack of current detection coverage.