ledger--live-support[.]pages[.]dev

Analysis of ledger--live-support.pages.dev shows that the domain is actively leveraged as a crypto‑draining campaign. The site is registered through Cloudflare, Inc., and its authoritative name servers are skip.ns.cloudflare.com and tia.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. DNS resolution points to the IP address 188.114.97.3, which is associated with a Cloudflare edge node and appears on a single security blocklist, confirming that external threat‑intel feeds have flagged the host.

VirusTotal scans have recorded 12 detections out of 91 security vendors, reinforcing the malicious classification. The domain is also listed as blocked by the PhishDestroy mitigation service, providing further corroboration of its hostile intent. No publicly available SSL/TLS certificate details, HTTP response codes, or page title information were retrieved at the time of analysis, leaving those surface‑level indicators unverified.

Consequently, defenders should treat the domain as hostile, enforce outbound DNS filtering to prevent resolution, and add the IP address 188.114.97.3 to network‑level blocklists. Continuous monitoring of Cloudflare‑associated traffic for similar sub‑domains is advised, as the hosting provider’s flexible sub‑domain creation can enable rapid re‑deployment of related crypto‑draining payloads.