upport-ledger-co-us[.]pages[.]dev

This domain, upport-ledger-co-us.pages.dev, is flagged as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site was designed to deceive users into believing they are interacting with legitimate Ledger support or account management infrastructure. No explicit crypto drainer kit signatures were identified in the available telemetry, but the domain structure and branding align with known tactics used in credential theft and wallet compromise campaigns. Infrastructure analysis reveals the domain was registered on September 25, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.98. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious Cloudflare-hosted sites. At the time of detection, only 2 out of 95 security vendors on VirusTotal flagged the domain as malicious, suggesting either low initial detection rates or evasion techniques. The domain appears on one security blocklist and was proactively blocked by at least one threat intelligence feed. Technologies detected include HTTP/3, HSTS, and Cloudflare-specific headers, which are frequently leveraged to enhance perceived legitimacy while obscuring backend infrastructure. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Historical DNS records and cached content could still pose a threat if accessed through archival services or local browser caches. Users are advised to verify any prior transactions or communications linked to this domain, monitor wallet addresses for unauthorized activity, and reset credentials if login attempts were made. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.