# PhishDestroy threat dossier — support-desk-lrdger.pages.dev ================================================================ Fetched: 2026-04-23 10:11:40 UTC Canonical: https://phishdestroy.io/domain/support-desk-lrdger.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Ledger ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 13/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, Fortinet, G-Data, Google Safebrowsing, Kaspersky, LevelBlue, Lionic, Netcraft, Sophos, VIPRE Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Cloudflare, Inc. Nameservers: damien.ns.cloudflare.com, raegan.ns.cloudflare.com Registered: 2026-03-30 Page title: Ledger Live Desktop – Manage Your Cryptocurrency Safely HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-06-27 Status: INVALID chain Fingerprint: 894c7ff934fcb1238f07edee71646ec64dbb0168a70c3efd04f427c0cbf2ae25 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-03-30 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-03-30 05:45:24 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:08:28 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d3c9f-1e63-774f-af51-50813700133a/ Wayback Machine: https://web.archive.org/web/*/support-desk-lrdger.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.support-desk-lrdger.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=support-desk-lrdger.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/support-desk-lrdger.pages.dev URLhaus: https://urlhaus.abuse.ch/host/support-desk-lrdger.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-03-30 05:47:16 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies support-desk-lrdger.pages.dev as a live phishing domain impersonating a legitimate support desk service, actively soliciting user credentials under the guise of technical assistance. This domain, hosted on Cloudflare Pages, leverages Cloudflare’s infrastructure to evade traditional takedown measures and maintain operational uptime. The threat actor behind this campaign has configured the domain to resolve to IP address 188.114.97.3, a known Cloudflare-operated range, further obscuring the true origin of the attack. The domain’s SSL certificate, issued by Google Trust Services, adds a veneer of legitimacy, tricking users into believing the site is secure and trustworthy. Analysts confirm this domain is flagged by Google Safe Browsing for social engineering tactics, with zero detections across 95 VirusTotal engines, indicating a low but dangerous profile that evades immediate detection. Registered through Cloudflare, Inc., the domain’s recent creation and active status suggest a rapidly deployed threat designed to capitalize on urgency and trust. Notably, the domain’s configuration and infrastructure choices—such as the use of Cloudflare Pages and a Google-issued SSL certificate—are hallmarks of modern phishing campaigns that prioritize evasion over sophistication. The absence of detections on VirusTotal underscores the need for proactive threat intelligence, as reactive detection mechanisms often lag behind attacker innovation. Users who have encountered or visited support-desk-lrdger.pages.dev should assume their credentials or sensitive data may have been compromised. Immediately cease any interaction with the domain and avoid submitting login details or personal information. If login credentials were entered, change passwords immediately and enable multi-factor authentication on all related accounts. Report the incident to your organization’s security team or, for personal accounts, to the appropriate service provider. Monitor accounts for unusual activity and consider running a malware scan on devices used to access the domain. PhishDestroy advises exercising extreme caution with unsolicited support requests, verifying the legitimacy of support channels independently, and reporting suspicious domains to enhance collective cybersecurity resilience. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 894c7ff934fcb1238f07edee71646ec64dbb0168a70c3efd04f427c0cbf2ae25 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/support-desk-lrdger.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=support-desk-lrdger.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io