support-liveledgr[.]pages[.]dev

This domain, support-liveledgr.pages.dev, is flagged as an active brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. The site presents itself as a "Secure Crypto Wallet" portal, likely designed to deceive users into entering sensitive recovery phrases or private keys under the guise of legitimate Ledger support. No explicit crypto drainer kit signatures have been identified yet, but the infrastructure aligns with known wallet-draining campaigns observed in prior Ledger impersonation cases. Infrastructure analysis reveals the following technical indicators: the domain was registered on September 06, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted in Canada under Cloudflare’s network. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted pages. VirusTotal currently reports 0 detections out of 95 engines, indicating the domain has not yet been widely flagged. The domain appears on one security blocklist and is blocked by PhishDestroy, though Google Safe Browsing has not yet classified it as malicious. As of the latest assessment, the domain remains active and operational. While some security vendors have begun blocking it, the lack of broader detection—particularly on VirusTotal—suggests the infrastructure may still pose a risk to unsuspecting users. Users encountering this domain are advised to avoid interaction, particularly any requests for wallet credentials or recovery phrases. Organizations should monitor for related indicators and update blocklists to include this domain and its resolving IP address. The low detection rate underscores the need for proactive threat hunting in crypto-related phishing campaigns.