# hone-ldger-io.pages.dev — SUSPICIOUS

> hone-ldger-io.pages.dev is being used in a fake Ledger hardware wallet phishing campaign. SSL certificate issued by Google Trust Services. Check the full report.

## Summary
A threat intelligence investigation by PhishDestroy has identified an active phishing campaign targeting cryptocurrency users through the domain hone-ldger-io.pages.dev. This campaign is distributing fraudulent Ledger hardware wallet recovery pages to steal seed phrases and private keys. The risk level is currently marked as 'under_investigation' due to the evolving nature of the campaign, but preliminary analysis confirms malicious intent and active distribution.

This domain resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may be leveraged to appear legitimate. VirusTotal currently flags this domain with 0/95 detections, indicating it has not yet been widely recognized by antivirus engines. As of the latest scan, this domain is not listed on any major blocklists, though this status may change as the campaign gains traction. The use of a Google Pages subdomain (pages.dev) adds a layer of deception, as it may blend in with legitimate Google-hosted content.

Users should avoid interacting with any links or pages associated with hone-ldger-io.pages.dev, particularly those claiming to offer Ledger wallet recovery services. If you have already entered sensitive information on this domain, immediately transfer all funds from the compromised wallet to a new, secure wallet and revoke any exposed API keys or permissions. Report the domain to your email provider, browser security extensions, and relevant cryptocurrency platforms. Enable multi-factor authentication and verify all wallet-related URLs against official Ledger domains before proceeding. Monitor your accounts for unauthorized transactions and consider using hardware wallets for enhanced security.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/1845d0db-de44-466b-9554-4670ef382b55
- PhishDestroy: https://phishdestroy.io/domain/hone-ldger-io.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/hone-ldger-io.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/hone-ldger-io.pages.dev/
Last updated: 2026-03-22