us-ledgr-com-start[.]pages[.]dev

This domain presents itself as a legitimate Ledger hardware wallet setup page, titled 'How to set up your Ledger hardware wallet | Ledger,' but is designed to steal cryptocurrency wallet credentials. The site mimics Ledger’s official branding and user interface, tricking victims into entering sensitive recovery phrases or private keys. Such credentials, once captured, allow attackers to drain associated wallets without authorization. The threat is particularly insidious because it exploits trust in a well-known brand, targeting users who may be unfamiliar with hardware wallet security procedures. Analysis indicates the domain was created on October 25, 2025, and is registered through Cloudflare, Inc. It resolves to the IP address 188.114.96.3 and uses a Google Trust Services SSL certificate to appear legitimate. Security vendors on VirusTotal flagged the domain, with 12 out of 95 detecting malicious activity. The site was also listed on one security blocklist and assigned a trust score of 0/100 by Gridinsoft. Technologies detected on the infrastructure include WordPress, Contentful, MySQL, PHP, Yoast SEO, Optimizely, OneTrust, and jQuery Migrate, which are not typically associated with Ledger’s official web properties. If you visited us-ledgr-com-start.pages.dev or entered any sensitive information, take immediate action to secure your assets. Disconnect any connected hardware wallets and cease all interactions with the domain. Generate a new recovery phrase for your Ledger device and transfer funds to a new wallet address. Monitor your wallet transactions for unauthorized activity and report the incident to your local cybercrime unit or relevant financial authorities. Avoid clicking on links from unsolicited emails or messages claiming to be from Ledger, and always verify the domain name before entering credentials.