ledger-start-com-cloud[.]pages[.]dev

This domain is actively impersonating Ledger, a hardware cryptocurrency wallet provider, to conduct credential-harvesting attacks. The site mimics legitimate Ledger wallet verification pages, tricking users into entering recovery phrases, private keys, or account credentials under the pretense of account verification or security updates. The attack vector targets cryptocurrency holders, aiming to gain unauthorized access to wallets and drain funds. Infrastructure analysis reveals the domain is designed to exploit trust in Ledger’s brand, using social engineering tactics to bypass security awareness. Analysis indicates the domain ledger-start-com-cloud.pages.dev was registered on September 09, 2025, through Cloudflare, Inc. and currently resolves to the IPv6 address 2a06:98c1:3121::3, hosted on Cloudflare’s network (AS13335). The domain lacks an SSL certificate, increasing the risk of interception during data transmission. As of the latest scan, 10 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on 1 security blocklist. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare’s automated systems have also identified the domain as suspicious, though it remains active. Users who visited this domain should immediately cease all interaction and assume any entered credentials or recovery phrases are compromised. If sensitive information was submitted, affected individuals must transfer cryptocurrency assets to a new wallet using a secure device and revoke access to any linked accounts. Enable multi-factor authentication on all associated services and monitor for unauthorized transactions. Report the domain to relevant security teams and consider notifying the impersonated brand’s official support channels for further mitigation guidance.