hub-ledre-en[.]pages[.]dev

PhishDestroy identifies the active domain 'hub-ledre-en.pages.dev' as a credential theft phishing campaign impersonating Ledger hardware wallet services. The infrastructure is currently active and under investigation for malicious operations targeting cryptocurrency users.

The domain hub-ledre-en.pages.dev is registered through Cloudflare, Inc., resolving to IP address 172.66.44.75. As of the latest assessment, the site has not been flagged by any of the 95 VirusTotal vendors and utilizes an SSL certificate issued by Google Trust Services. The domain is hosted on Cloudflare Pages, a platform often abused for short-lived phishing campaigns. The infrastructure shows no immediate blocklist presence, though trust indicators remain low due to the absence of detections and the impersonation of a high-risk target—Leger wallet users. The seed identifier 'c8d6b0' confirms this as a unique campaign variant.

This domain is assessed as ACTIVE and poses a HIGH RISK to users attempting to access Ledger wallet services or related cryptocurrency interfaces. Given the lack of detection coverage and the immediate threat to financial assets, organizations and individual users are advised to block the domain at the network and DNS levels. Additionally, users who may have interacted with this domain should immediately revoke any entered credentials, enable two-factor authentication on all crypto-related accounts, and monitor for unauthorized transactions. Security teams should flag this indicator in SIEM and EDR solutions as a confirmed credential theft site.