start-ledger-liv[.]pages[.]dev

On July 25, 2026, the domain start-ledger-liv.pages.dev was identified as a brand impersonation threat targeting Ledger. The domain was created on March 23, 2026, and is currently offline, with an HTTP status code of 403. This indicates that the server is refusing to respond to the request, possibly due to the domain being taken down or blocked. The domain appears on one security blocklist and is flagged by PhishDestroy.

The page title 'Ledger Start – Secure Setup for Your Hardware Wallet' suggests that the domain was designed to mimic a legitimate Ledger setup page, potentially to deceive users into providing sensitive information such as login credentials or personal data. The SSL certificate is issued by Google Trust Services, which might have been used to gain user trust. The domain is registered through Cloudflare, Inc., and the nameservers are elinore.ns.cloudflare.com and rudy.ns.cloudflare.com. The IP address 188.114.97.3 is located in California, USA, and is associated with Cloudflare, Inc. Infrastructure analysis reveals the use of HSTS, Cloudflare, and HTTP/3 technologies.

The Gridinsoft trust score for this domain is 0 out of 100, indicating a high level of suspicion. Defenders should ensure that this domain is blocked in their network and security configurations to prevent any potential compromise. Users should be educated to verify the authenticity of any Ledger-related setup pages by directly accessing the official Ledger website or using verified Ledger applications. Further monitoring is recommended to detect if the domain is reactivated or if similar domains are registered.