start-ledgirs[.]pages[.]dev

PhishDestroy identifies active Ledger wallet phishing on start-ledgirs.pages.dev (unique seed 4a0449). This Cloudflare Pages domain is currently impersonating the Ledger hardware wallet ecosystem to harvest seed phrases and private keys. The campaign remains active as of the latest scan, with threat actors leveraging HTTPS infrastructure to deceive security tools. This domain was flagged by 7 of 95 VirusTotal vendors at the time of analysis, indicating a low detection rate despite malicious intent. It was registered through Cloudflare, Inc., resolves to IP 172.66.47.50, and holds a Google Trust Services SSL certificate. No blocklist entries were found in major threat intelligence feeds, and the domain shows no prior reputation incidents. Creation date and additional metadata are not publicly disclosed via standard WHOIS due to Cloudflare privacy protection. The status remains under investigation, but concrete risks are present. PhishDestroy strongly recommends immediate blocking of start-ledgirs.pages.dev at network and endpoint levels. Users who accessed this domain should assume credential or cryptocurrency exposure and rotate all associated Ledger wallet keys and passwords. Report any interactions to Ledger’s official support channel at support@ledger.com. Monitor traffic for connections to 172.66.47.50 (AS13335 Cloudflare).