support-liveledgir[.]pages[.]dev

The domain support-liveledgir.pages.dev is currently identified as a high-risk threat due to its involvement in brand impersonation targeting Ledger. This domain mimics the legitimate Ledger Live interface, potentially deceiving users into believing they are interacting with the official Ledger site. No specific crypto drainer kits have been identified, but the impersonation suggests a focus on credential theft.

Technical analysis reveals several critical indicators of compromise. The domain is flagged by 10 out of 95 security vendors on VirusTotal, indicating significant suspicion within the cybersecurity community. It was registered through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.167, located in Canada. The SSL certificate is issued by Google Trust Services / WE1, adding a layer of perceived legitimacy. The domain was created on March 26, 2026, and remains active, appearing on at least one security blocklist.

The current status of the domain is active, with ongoing risks to potential victims. It is blocked by at least one security provider, PhishDestroy, which reduces, but does not eliminate, the threat. Users and organizations are advised to block the domain at the network level and educate users about the dangers of interacting with sites that closely mimic trusted brands. Continuous monitoring and quick response actions are essential to mitigate the risk posed by this domain.