ledger--wallet--get[.]pages[.]dev

The domain ledger--wallet--get.pages.dev is currently active and classified as a crypto‑drainer threat with an elevated risk rating. Infrastructure analysis shows the domain is hosted behind Cloudflare, Inc., using the authoritative nameservers indie.ns.cloudflare.com and rohin.ns.cloudflare.com. DNS resolution points to the IPv4 address 172.66.47.60, a host that appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy feed.

VirusTotal reports that seven of ninety‑one scanning engines have flagged the domain as malicious, indicating a non‑trivial detection consensus among security vendors. The domain’s registration through Cloudflare suggests the attacker is leveraging the provider’s privacy‑preserving services to obscure ownership details. No additional metadata such as SSL certificate details, HTTP response codes, or page titles has been supplied, leaving those vectors unverified at this time.

Uncertainty remains around the exact phishing landing page content, the specific cryptocurrency wallets targeted, and the presence of any additional command‑and‑control infrastructure. Defenders should add the domain and its resolving IP address to outbound filtering rules, monitor DNS queries for these nameservers, and ensure that any internal alerts triggered by the seven VirusTotal detections are escalated. Continuous re‑evaluation is advised, as further analysis of the web content or network traffic could reveal additional indicators of compromise.