live-ldger-desktop-support[.]pages[.]dev

PhishDestroy’s automated threat pipeline detected the domain live-ldger-desktop-support.pages.dev operating as a credential theft endpoint targeting cryptocurrency users. The site currently poses an elevated risk and remains active as of the latest scan cycle. This domain was flagged by 11 of 95 VirusTotal security vendors, indicating widespread consensus on its malicious nature. It is registered through Cloudflare, Inc. and resolves to IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services, a technique commonly abused to lend false legitimacy to phishing infrastructure. Threat analysis reveals the infrastructure is provisioned on Cloudflare Pages, a legitimate platform repurposed for quick deployment of spoofed login portals. The domain’s low trust scores across multiple engines, combined with its recent activation and active hosting, elevate the risk of successful compromise. Credential theft campaigns leveraging such domains often result in direct financial loss for cryptocurrency holders. PhishDestroy recommends immediate network-level blocking of live-ldger-desktop-support.pages.dev and 188.114.97.3. Users are advised to verify all login URLs via official channels and enable multi-factor authentication on cryptocurrency platforms. Organizations should update firewall and proxy rules to deny traffic to this domain and IP. Monitor endpoints for signs of unauthorized access or data exfiltration linked to this campaign.