app-ledger-start[.]pages[.]dev

App-ledger-start.pages.dev actively impersonates the Ledger brand, as indicated by its page title mimicking the official Ledger site. Detected on the same day it was created, this domain is already flagged by 15 out of 94 vendors on VirusTotal and listed on PhishDestroy's blocklist. Google Safe Browsing also identifies it as malicious, underscoring its threat level.

The domain is registered through Cloudflare, Inc., and hosted on IP address 188.114.96.3 in Canada, managed by CloudFlare, Inc. This infrastructure choice suggests a focus on leveraging reputable services to mask malicious intent. The SSL certificate is issued by Google Trust Services, adding a veneer of legitimacy that could deceive users into believing they are interacting with the genuine Ledger site.

This phishing operation targets users by exploiting the trust associated with the Ledger brand. The high platform risk score of 100/100 highlights the potential danger to users who might inadvertently provide sensitive information. The combination of a misleading page title and legitimate-looking SSL certification creates a convincing facade for unsuspecting visitors.

PhishDestroy's early detection of app-ledger-start.pages.dev demonstrates the importance of proactive threat hunting. By identifying such domains at the point of registration, PhishDestroy captures threats before they propagate through antivirus databases, offering a crucial window for mitigation. This case exemplifies the ongoing challenge of combating phishing attacks that leverage brand impersonation and advanced obfuscation techniques.