new-ledgr-start[.]pages[.]dev

This domain is flagged as a brand impersonation threat specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to mimic the legitimate Ledger Start onboarding page, using identical page titles and visual branding to deceive users into entering sensitive wallet recovery phrases or private keys. Such tactics are commonly employed to facilitate unauthorized access to cryptocurrency holdings, leading to potential asset theft or compromise of associated accounts. Infrastructure analysis reveals the domain was registered on March 23, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted under Cloudflare’s network in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s infrastructure. Security vendor detections on VirusTotal report 14 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The domain has since been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Users who visited new-ledgr-start.pages.dev or entered any credentials, recovery phrases, or private keys should assume compromise. Immediate actions include revoking access to any connected wallets, generating new recovery phrases, and transferring assets to a new, secure wallet. Additionally, affected users should monitor associated accounts for unauthorized transactions and enable multi-factor authentication where available. If hardware wallet devices were initialized or connected via this domain, a full device reset and reinitialization is recommended to mitigate persistent threats.