supp-ldger-live[.]pages[.]dev

PhishDestroy identifies the domain supp-ldger-live.pages.dev as an active crypto-draining phishing page. The page masquerades as a legitimate Ledger Live interface and leverages a drainer kit designed to siphon Solana-based tokens from unwitting users. This particular strain uses a spoofed login flow to harvest seed phrases or private keys, then transfers assets to attacker-controlled wallets. The campaign is selective, targeting cryptocurrency holders with fake “firmware update” or “account verification” prompts.

This domain was registered through Cloudflare, Inc. using Google Trust Services for SSL certificates. VirusTotal shows a dismal detection rate of just 1 out of 95 security engines, with the infrastructure resolving to IP 188.114.96.3. The low VT score is consistent with newly observed infrastructure, indicating it has likely evaded broad detection through rapid rotation and subtle obfuscation. While Google Safe Browsing (GSB) currently shows no blocklist entry for this domain, the page has already been flagged by multiple private threat intelligence feeds and community sandboxes. At the time of analysis, the site shows no active blocklist presence on major DNS filtering services, increasing the risk of accidental exposure.

PhishDestroy assesses this domain as HIGH RISK due to its active deployment, low detection coverage, and clear intent to steal digital assets. Immediate blocking of 188.114.96.3 and the domain supp-ldger-live.pages.dev is recommended across corporate and residential networks. Users are strongly advised to verify any Ledger-related link using the official Ledger Live application or website. Until this site is universally blocked, treat all unsolicited links referencing Ledger or Solana wallet updates as malicious. While the current campaign appears limited in scope, its reliance on Google Pages and Cloudflare hosting suggests potential for rapid expansion. Remaining risk is ELEVATED given the low VT coverage and absence from major blocklists.