ledg-support-live[.]pages[.]dev

PhishDestroy identifies ledg-support-live.pages.dev as a live crypto drainer campaign masquerading as official Ledger Live support. The domain leverages a Pages.dev subdomain to mimic legitimacy while hosting JavaScript-based wallet drainer kits targeting cryptocurrency users. Investigation reveals active redirection chains designed to siphon funds from unsuspecting victims under the guise of 'security updates' or 'account recovery.' This domain exhibits several red flags confirmed by forensic analysis. VirusTotal currently scores it 8/95 detections despite active abuse reports, while it resolves to IP 188.114.97.3 via Cloudflare’s infrastructure. Registered through Cloudflare, Inc. with a Google Trust Services SSL certificate, the domain shows signs of recent creation but remains unblocked by major threat intelligence platforms. Its Pages.dev origin further complicates detection due to Cloudflare’s benign reputation masking malicious payloads. Currently active and unmitigated, ledg-support-live.pages.dev poses a HIGH risk to cryptocurrency holders. PhishDestroy has flagged this domain for immediate analysis, though full takedown may require Cloudflare intervention due to its Pages.dev hosting. Users are advised to avoid all links associated with this domain and verify any Ledger-related communications through official channels. Remaining risk is assessed as CRITICAL pending further takedown actions.