ledggerr-com-start[.]pages[.]dev

This domain, ledggerr-com-start.pages.dev, is actively impersonating Ledger wallet setup pages as of July 12, 2026. Infrastructure analysis reveals the domain was registered on March 23, 2026, through Cloudflare, Inc., and currently resolves to IP address 188.114.96.3. The page title explicitly references 'Ledger.com/Start® - Secure Wallet Setup,' indicating a direct attempt to mimic the legitimate Ledger wallet initialization process. Detection data shows the domain appears on one security blocklist, while a scan by 95 security vendors identified 15 detections, suggesting moderate but not universal recognition of the threat. The site employs standard web technologies including Tailwind CSS, HSTS, and Cloudflare infrastructure, which may help it evade basic detection filters. The SSL certificate is issued by Google Trust Services, adding a layer of apparent legitimacy. Defenders should note that the domain remains active and unmitigated, with a Gridinsoft trust score of 0/100. While the exact content of the phishing page has not been analyzed, the combination of brand impersonation, recent registration, and detection by multiple security vendors indicates a high-risk threat targeting cryptocurrency users. Immediate blocking of the domain and associated IP is recommended, alongside monitoring for related subdomains or newly registered lookalike domains under the same registrar.