ledger-support-com-x[.]pages[.]dev

Analysis of ledger-support-com-x.pages.dev, observed on July 29, 2026, confirms active crypto drainer infrastructure hosted under the Cloudflare Pages platform. The domain is registered through Cloudflare, Inc., with nameservers dax.ns.cloudflare.com and hope.ns.cloudflare.com, resolving to IP address 172.66.44.64. This IP falls within Cloudflare's network, a common hosting choice for both legitimate services and malicious campaigns due to its proxy capabilities and ease of deployment. VirusTotal detection metrics indicate that 9 out of 91 security vendors flag this domain as malicious, a clear signal of confirmed abuse. The domain also appears on at least one security blocklist, further corroborating its classification as a threat.

PhishDestroy has already blocked this domain, reinforcing its malicious designation. No contradictory evidence, such as a clean trust score or Safe Browsing classification, is present in the available data. The domain name itself, ledger-support-com-x.pages.dev, is structured to impersonate support services for Ledger, a well-known hardware wallet provider, suggesting an intent to deceive users seeking assistance with cryptocurrency storage. While the exact content of the site has not been analyzed, the naming convention aligns with known crypto drainer phishing tactics, where attackers lure victims into connecting wallets to malicious smart contracts that drain funds.

Defenders should treat this domain as an active threat. Immediate actions include blocking the domain and its resolving IP at the network level, updating endpoint protection rules, and alerting users to avoid interaction. Given the use of Cloudflare infrastructure, monitoring for newly deployed subdomains or pages under the same parent domain (pages.dev) is recommended to preempt further abuse. No evidence of takedown or remediation is present as of this report.