secure-ledger-guide[.]square[.]site

Analysis of secure-ledger-guide.square.site as of August 01, 2026 indicates the domain is actively used in a crypto‑drainer campaign. The domain resolves to the IPv4 address 74.115.51.5 and is registered via Square, Inc., suggesting the registrar is a legitimate commerce platform but does not imply endorsement of the malicious activity. VirusTotal has recorded detections from 14 out of 91 scanning engines, confirming that a notable fraction of security vendors consider the site malicious. The domain is presently listed on two public blocklists and is actively blocked by the PhishDestroy and OpenPhish feeds, further corroborating its threat status.

Nameserver information could not be retrieved (NS_NOT_FOUND), limiting visibility into the hosting infrastructure and making it harder to attribute the underlying server provider. No additional data such as SSL certificate details, HTTP response codes, or page title have been disclosed, leaving the exact content and delivery mechanisms of the drainer undisclosed. Defenders should treat any traffic to or from 74.115.51.5 associated with the domain as hostile.

Recommended actions include adding the domain and its IP address to network‑level deny lists, enforcing DNS sink‑hole rules, and monitoring outbound connections for cryptocurrency‑related payloads. Incident response teams should also flag any user‑initiated authentication attempts that redirect to this host for further investigation, and consider sharing the indicator of compromise with internal threat‑intel platforms to enrich detection rules. Continuous re‑evaluation is advised, as the lack of visible infrastructure details may allow the operators to shift hosting while retaining the same domain name.