hublearndesktop-login[.]webflow[.]io

This domain, hublearndesktop-login.webflow.io, is actively impersonating Ledger, a well-known hardware wallet provider, to deceive users into submitting sensitive credentials. The page presents a fraudulent Ledger Live login interface, designed to harvest authentication details, recovery phrases, or private keys under the guise of legitimate account access. Such brand impersonation campaigns are commonly used to facilitate unauthorized access to cryptocurrency wallets, leading to asset theft or account compromise. Analysis indicates the domain was registered on May 8, 2013, through MarkMonitor, Inc., though the current phishing content appears to be a recent deployment. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, hosted on Cloudflare, Inc. (AS13335) infrastructure located in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious sites to avoid immediate suspicion. Detection metrics show 17 out of 95 security vendors on VirusTotal have flagged the domain as malicious. Additionally, the domain appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. Users who have visited hublearndesktop-login.webflow.io or entered credentials on the site should immediately revoke access to any associated Ledger accounts or wallets. It is critical to change passwords, enable multi-factor authentication where available, and monitor accounts for unauthorized transactions. If recovery phrases or private keys were exposed, users should transfer assets to a new, secure wallet and consider the compromised wallet as permanently untrustworthy. Organizations and individuals are advised to block the domain and its resolving IP address (104.18.36.248) at the network level to prevent further exposure.