hub-io-legar[.]pages[.]dev

This domain, hub-io-legar.pages.dev, is actively impersonating Ledger through a fraudulent login portal designed to harvest cryptocurrency wallet credentials. The page presents itself as "Ledger Live - Secure Login", a direct mimicry of the legitimate Ledger wallet management interface. Analysis indicates this is a high-risk brand impersonation attack targeting users of the Ledger hardware wallet ecosystem, likely intended to facilitate unauthorized access to private keys or seed phrases. Infrastructure analysis reveals the domain resolves to IP address 172.66.44.125, hosted on Cloudflare infrastructure in California. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted pages. The domain was registered on April 3, 2026, through Cloudflare, Inc., and is currently flagged by 2 of 95 security vendors on VirusTotal. It appears on one security blocklist, as documented by PhishDestroy, and remains operational as of the latest verification. The use of Cloudflare Pages (.pages.dev) provides the attacker with a reputable-looking subdomain and SSL encryption, increasing the likelihood of successful deception. Current status confirms the domain remains active and unmitigated. Users are advised to avoid interaction with hub-io-legar.pages.dev and any associated links. Organizations should update web filtering rules to block the domain and IP 172.66.44.125, and monitor for credential exposure tied to this infrastructure. Ledger users should verify all login attempts through official channels only, enable multi-factor authentication where available, and inspect URLs carefully for subtle misspellings or unusual subdomains. Security teams are encouraged to correlate this domain with other Ledger-themed phishing campaigns and investigate potential lateral movement within affected networks.