# support-liveledgir.pages.dev — SUSPICIOUS

> support-liveledgir.pages.dev is a live crypto-drainer impersonating Live Ledger (VirusTotal: 0/95). Do NOT interact. Block and report immediately.

## Summary
PhishDestroy identifies support-liveledgir.pages.dev as an active crypto drainer domain masquerading as a Live Ledger support portal. This domain leverages a spoofed ‘Live Ledger’ branding to trick users into connecting crypto wallets and initiating unauthorized transfers. No specific drainer kit has been isolated in available telemetry, but the site’s behavior aligns with generic crypto-draining scripts commonly observed in similar attacks. The infrastructure is hosted on Cloudflare Pages, suggesting low-cost, rapidly deployable hosting designed to evade traditional detection mechanisms.  

This domain resolves to IP 172.66.47.167 and is served over HTTPS using a Google Trust Services SSL certificate, adding a false sense of legitimacy. VirusTotal currently returns a detection rate of 0/95 engines, indicating it has not yet been flagged by antivirus or threat intelligence platforms. It was registered through Cloudflare, Inc., and points to a Cloudflare Pages deployment—both factors that obscure true ownership and complicate takedown efforts. No additional data (e.g., creation date or blocklist status) is available from public sources at this time, placing its operational age and reputation status under investigation.  

Currently, this domain remains active and poses an elevated risk to cryptocurrency users. Given the absence of detections and the use of cloud hosting, proactive blocking via DNS or browser-level URL filtering is recommended. Users should avoid visiting this site and report it to relevant security teams or abuse channels. Risk remains high until the drainer script is identified, the hosting provider takes action, or the domain is added to major blocklists. Monitor for updates as this threat evolves.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.167

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/96fc2714-71e7-4ebb-9cb9-d88053e61f20
- PhishDestroy: https://phishdestroy.io/domain/support-liveledgir.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/support-liveledgir.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/support-liveledgir.pages.dev/
Last updated: 2026-03-26