ledgr-com-usstart[.]pages[.]dev

Analysis of the domain ledgr-com-usstart.pages.dev indicates a confirmed brand-impersonation phishing campaign targeting Ledger, a hardware wallet provider. The domain was registered on October 16, 2025, and remains active as of July 12, 2026. It is hosted on Cloudflare Pages infrastructure and resolves to the IP address 188.114.97.3. The page title, 'Ledger Getting Started Hub – Official Guide to Hardware Wallet Setup and Digital Security,' explicitly mimics Ledger’s official documentation, suggesting an intent to deceive users into engaging with fraudulent setup instructions or credential harvesting mechanisms. Security vendor detections on VirusTotal report 13 flags out of 95 scans, and the domain appears on one security blocklist, specifically PhishDestroy. The Gridinsoft trust score for this domain is 0/100, further corroborating its malicious classification. Technical indicators reveal the use of Tailwind CSS, HSTS, Cloudflare, and HTTP/3, which are consistent with modern phishing infrastructure but do not inherently confirm malicious intent without additional context. The SSL certificate is issued by Google Trust Services, a legitimate provider, which may reduce user suspicion but does not mitigate the domain’s fraudulent purpose. Defenders should treat this domain as high-risk and prioritize blocking or monitoring its resolution within corporate or consumer environments. No evidence currently links this domain to a specific phishing kit or broader campaign, and the exact content of the site remains unanalyzed. Further investigation into associated IPs, certificates, or redirect chains may reveal additional infrastructure tied to this threat.