ledger-eng-start[.]typedream[.]app

The domain ledger-eng-start.typedream.app is currently flagged as a high‑risk crypto drainer. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3 and is registered through the Typedream service, which is commonly used for rapid website deployment. The domain is listed on two public security blocklists and has been explicitly blocked by PhishDestroy and OpenPhish.

VirusTotal reports that 17 of 91 security vendors have flagged the domain, indicating moderate consensus among scanning engines that the site is malicious. Nameserver information is unavailable (NS_NOT_FOUND), and no additional telemetry such as SSL certificate details, HTTP response codes, or Safe Browsing verdicts are present in the available intelligence. The lack of a known page title or brand impersonation prevents confirmation of the exact visual lure, but the classification as a crypto drainer suggests the site attempts to solicit cryptocurrency transfers from victims.

Defenders should immediately add ledger-eng-start.typedream.app to internal DNS blocklists and firewall deny lists, and consider sinkholing the resolved IP 188.114.96.3 to disrupt any ongoing command‑and‑control or payment flows. Continuous monitoring of outbound traffic for attempts to resolve this domain or contact the associated IP is advised, as the threat remains active. Given the presence on multiple blocklists and the positive detection count from VirusTotal, the domain should be treated as hostile until a formal takedown or remediation is confirmed.