supp-liv-ledger-desktop[.]pages[.]dev

The domain supp-liv-ledger-desktop.pages.dev is currently classified as a high‑risk crypto drainer and remains active as of the report date 29 July 2026. Infrastructure analysis shows the domain resolves to the IP address 172.66.47.42 and is hosted behind Cloudflare, Inc., using the authoritative nameservers izabella.ns.cloudflare.com and jeff.ns.cloudflare.com. Cloudflare’s edge network provides anonymity for the operator, while the underlying address belongs to a network frequently leveraged for malicious campaigns. Reputation services provide converging evidence of malicious intent. Google Safe Browsing lists the domain under the social‑engineering category, and PhishDestroy has actively blocked it.

In addition, the domain appears on a single external blocklist, indicating that at least one third‑party security feed has added it to its deny list. VirusTotal reports that ten out of ninety‑one scanning engines have flagged the domain, reinforcing the suspicion that it is being used to harvest cryptocurrency credentials or to redirect victims to malicious wallets. No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact payload and delivery mechanism unverified. Consequently, defenders cannot confirm whether the site hosts a fake wallet interface, a malicious downloader, or another form of crypto‑related fraud. The absence of such content analysis represents the primary uncertainty in the current intelligence.

Given the existing indicators, security teams should implement preventive controls. Recommended actions include adding the domain to URL filtering policies, updating intrusion‑prevention signatures to block traffic to 172.66.47.42, and monitoring DNS logs for any resolution attempts. Organizations using cryptocurrency services should treat any authentication request originating from this domain as malicious and advise users to avoid interaction.