leger-com-starts-us[.]pages[.]dev

PhishDestroy identifies leger-com-starts-us.pages.dev as an active phishing domain masquerading as a Ledger hardware wallet onboarding page. The site is currently under investigation for generic phishing tactics targeting cryptocurrency users. No brand impersonation beyond Ledger branding has been confirmed at this stage.

This domain resolves to IP 172.66.47.160 and remains undetected by 4 out of 95 VirusTotal security vendors as of the latest scan. It operates under Cloudflare, Inc. registration and utilizes a Google Trust Services SSL certificate, which does not guarantee legitimacy due to widespread abuse of free TLS issuance. The domain was created recently and has not yet accumulated blocklist entries, indicating a fresh deployment likely intended for short-term credential harvesting campaigns.

The domain remains active and poses a high risk to visitors expecting secure Ledger wallet services. Users are strongly advised to avoid interacting with this domain and to verify wallet URLs through official Ledger channels. Security teams should monitor for further infrastructure pivots and consider blocking IP 172.66.47.160 at the network perimeter. Immediate report checks are recommended for affected users.