user-ledgr-strt-com[.]pages[.]dev

This domain, user-ledgr-strt-com.pages.dev, is currently hosting a page titled “Ledger.com/Start® | Securely Set Up Your Ledger Wallet”. The page title directly mimics the official Ledger onboarding flow, indicating a deliberate brand‑impersonation campaign aimed at luring Ledger users into divulging credentials or seed phrases.

The site resolves to IP 172.66.45.41, a Cloudflare‑owned address located in Canada. The TLS certificate is issued by Google Trust Services under the “WE1” designation, and the server presents HSTS and HTTP/3 headers, suggesting a modern configuration. Nameservers fish.ns.cloudflare.com and huxley.ns.cloudflare.com belong to Cloudflare’s DNS service. The domain was created on 18 September 2025 and registered through Cloudflare, Inc., indicating a recent registration timeline consistent with fast‑flux phishing deployments.

VirusTotal has flagged the domain with 16 detections out of 95 scanned security vendors, and Gridinsoft assigns a trust score of 0 / 100, reflecting a high confidence of malicious intent. The domain appears on at least one active blocklist and has already been blocked by PhishDestroy. No additional infrastructure such as command‑and‑control hosts or malicious payloads were disclosed, leaving the exact data‑exfiltration mechanism uncertain, but the combination of brand‑spoofed UI and low trust scores strongly suggests credential‑harvesting activity.

Defenders should add user-ledgr-strt-com.pages.dev to network and endpoint block lists, enforce DNS sink‑hole policies for the associated Cloudflare nameservers, and monitor for outbound connections to 172.66.45.41. Organizations using Ledger hardware wallets should issue user alerts warning against unsolicited “Start” pages and require verification of the URL before any wallet setup. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure.