suport-ledgerrliv-cdn[.]pages[.]dev

PhishDestroy identifies suport-ledgerrliv-cdn.pages.dev as an active crypto drainer operation leveraging deceptive Cloudflare Pages infrastructure to harvest cryptocurrency wallet credentials and tokens. The domain mimics legitimate cryptocurrency support pages to trick users into connecting their wallets, where malicious JavaScript exfiltrates private keys and initiates unauthorized transfers. Threat actors registered this domain through Cloudflare, Inc. and host it on Google Trust Services SSL certificates, adding a veneer of legitimacy while facilitating credential theft and asset drainage. This domain resolves to IP 172.66.46.249 and exhibits elevated risk characteristics, with VirusTotal reporting only 1 out of 95 security vendors detecting the malicious nature at the time of analysis. Such low detection rates indicate this threat may be bypassing traditional security controls, likely due to its use of reputable hosting and SSL infrastructure. The combination of Cloudflare's Pages service, Google's certificate authority, and minimal signature coverage makes this a sophisticated and stealthy operation targeting cryptocurrency users. Users who may have visited suport-ledgerrliv-cdn.pages.dev should immediately disconnect their wallets, revoke any connected permissions, and transfer remaining assets to a newly generated wallet with updated security measures. Enable multifactor authentication on all exchange and wallet accounts, and consider implementing hardware security modules for critical holdings. Report any unauthorized transactions to relevant blockchain forensic services and file incident reports with your organization's security team if corporate or institutional accounts were exposed. Monitor wallet addresses and transaction histories closely for signs of compromise, as crypto drainer operations often maintain persistence through token approvals and signed messages.