trexor-io-start-en-us[.]pages[.]dev

This domain, trexor-io-start-en-us.pages.dev, poses a direct threat as a brand impersonation phishing site targeting Ledger hardware wallet users. The site mimics the official Ledger.com/start setup guide, presenting a fraudulent interface designed to harvest recovery phrases, private keys, or other sensitive authentication credentials. Users attempting to initialize or recover a Ledger device may unknowingly submit critical security information to attackers, enabling unauthorized access to cryptocurrency wallets and potential asset theft. Analysis of the domain infrastructure reveals multiple high-risk indicators. The domain is flagged by 14 out of 95 security vendors on VirusTotal, with one confirmed appearance on security blocklists. Registered through Cloudflare, Inc. on April 04, 2026, the domain resolves to the IP address 172.66.47.204, hosted in Canada under Cloudflare’s network. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy while the page title, "Starting® Up® Your® Device® - Ledger.com/start® Guide," closely replicates the official branding to deceive users. Users who have visited trexor-io-start-en-us.pages.dev should immediately cease all interaction with the site. If any sensitive information, such as recovery phrases or private keys, was entered, the affected Ledger device and associated wallets should be considered compromised. Users are advised to transfer assets to a new, secure wallet using a verified device and initiate a factory reset on the compromised hardware. Additionally, monitoring for unauthorized transactions and reporting the incident to relevant security teams or cryptocurrency platforms is recommended to mitigate further risk.