new-lehjrecomstart[.]pages[.]dev

This domain, new-lehjrecomstart.pages.dev, is flagged for brand impersonation, posing a significant threat to users of the Ledger brand. The site is designed to mimic the official Ledger pages, particularly focusing on content related to getting started and securing cryptocurrencies. The primary risk is that users visiting this domain may be tricked into providing personal information, such as login credentials or financial details, which can be used for malicious purposes.

Infrastructure analysis reveals that new-lehjrecomstart.pages.dev was registered through Cloudflare, Inc., and created on March 23, 2026. The domain resolves to the IP address 188.114.96.3, located in California, USA. VirusTotal, a reputable security platform, flags this domain with 18 out of 95 security vendors indicating potential phishing activities. Additionally, Google Safe Browsing has identified this domain as a phishing site, and it appears on one security blocklist. The domain is currently offline and blocked by PhishDestroy, further indicating its malicious nature. The SSL certificate, issued by Google Trust Services, is WE1, which does not necessarily imply security but can add to the site's credibility to unsuspecting users.

If users have visited new-lehjrecomstart.pages.dev, they should immediately check their Ledger accounts for any unauthorized activity. It is recommended to change passwords and enable two-factor authentication (2FA) if not already active. Users should also monitor their financial statements for any suspicious transactions and consider running a full system scan for malware. Reporting any potential phishing attempts to Ledger's official support channels is crucial to help prevent further incidents and protect other users.