portal-hub-ledger[.]com

The domain portal-hub-ledger.com was registered on November 20, 2025 through Amazon Registrar, Inc. and is hosted on Amazon AWS infrastructure (AS16509) with the IP address 35.92.221.77 located in the United States. Four AWS name servers (ns-1308.awsdns-35.org, ns-1838.awsdns-37.co.uk, ns-426.awsdns-53.com, ns-657.awsdns) resolve the domain, indicating a typical cloud‑based deployment. No SSL certificate is present, meaning traffic is served over plain HTTP, and the site currently returns a page titled “Are you human ?”. VirusTotal reports that 14 of 95 security vendors have flagged the domain, and it appears on a single security blocklist.

PhishDestroy has already blocked the domain, and Gridinsoft assigns a trust score of 0 out of 100, underscoring the high confidence that the site is malicious. The threat is classified as a crypto scam that impersonates the Ledger brand, targeting users who may expect legitimate Ledger services. The domain’s status is listed as offline, but historical activity suggests it was used to lure victims into a credential‑stealing or cryptocurrency‑draining flow. Defenders should continue to monitor the IP and associated AWS name servers for any re‑activation, add the domain and its IP to internal blocklists, and update web‑filtering and endpoint protection rules to reflect the observed indicators.

Threat‑intel teams should also share the indicator set with industry‑wide blocklist providers to ensure broader protection. Uncertainty remains around the exact payload delivered after the “Are you human ?” challenge, as no further page content has been catalogued. Until the site is taken down permanently, security operations should treat any traffic to this domain as hostile and enforce strict blocking policies.