strt-ldgrr-cloud[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting cryptocurrency hardware wallet users through a crypto drainer scheme. Analysis indicates the infrastructure was specifically designed to deceive users attempting to initialize or recover Ledger devices, as evidenced by the page title 'Get Started with Ledger | Ledger.com/start' and the domain's semantic structure mimicking legitimate onboarding flows. Infrastructure analysis reveals the domain strt-ldgrr-cloud.pages.dev was registered on April 12, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Detection metrics show 0/95 detections on VirusTotal, indicating the domain has evaded widespread detection thus far. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist, suggesting emerging but unconfirmed malicious activity. The domain's current offline status may indicate takedown action or operational pause by threat actors. Mitigation against this specific threat type requires heightened user verification of domain authenticity before entering recovery phrases or connecting wallets. Users should cross-reference official documentation to confirm legitimate onboarding URLs, as crypto drainers often exploit the irreversible nature of blockchain transactions. Organizations should monitor for similar Cloudflare-registered domains containing 'ldgr' or 'ledger' variants, particularly those resolving to the 188.114.96.0/22 range. Security teams are advised to preemptively block the observed IP and domain, while end-users should treat any unexpected wallet initialization prompts as potential compromise attempts.