hub-ledgrwalet-eng[.]pages[.]dev

PhishDestroy has identified hub-ledgrwalet-eng.pages.dev as an elevated-risk domain engaged in brand impersonation specifically targeting Ledger users. The threat type is a crypto drainer and fake login page designed to steal cryptocurrency wallet credentials. This site was created on March 24, 2026, and while currently offline, it poses a significant risk to anyone who may have visited it while active. The page title "Ledger® Wallet | Getting Started with Ledger Live" is a direct attempt to deceive users into believing they are on an official Ledger support page.

Technical analysis reveals that the domain resolves to IP address 188.114.97.3, which is associated with Cloudflare's infrastructure. The SSL certificate was issued by Google Trust Services / WE1, which is legitimate but does not verify the site's authenticity. VirusTotal flags show that 8 out of 95 security vendors have identified this domain as malicious, and it appears on one security blocklist. The domain was registered through Cloudflare, Inc., a common registrar for phishing sites due to its anonymity features. These indicators collectively confirm the malicious nature of the site.

Users who may have interacted with this site should immediately change their Ledger Live passwords and enable two-factor authentication. Never enter your 24-word recovery phrase on any website, as legitimate companies like Ledger will never ask for it. Always verify URLs carefully; the official Ledger domain is ledger.com. For future protection, use PhishDestroy's browser extension to automatically block known phishing sites and report any suspicious domains you encounter. If you suspect your wallet has been compromised, transfer funds to a new wallet created on a secure device and contact Ledger support directly.