desktop-ledgercom-live[.]typedream[.]app

This domain, desktop-ledgercom-live.typedream.app, is currently flagged as an active crypto‑drainer infrastructure. VirusTotal records show that 13 of 91 scanning engines have identified malicious behavior associated with the domain, indicating a moderate to high confidence of abuse. The domain resolves to the IP address 188.114.97.3, which is not presently linked to a known legitimate service and appears on two public blocklists. Reputation services PhishDestroy and OpenPhish have added the domain to their deny lists, reinforcing the assessment that it is being used for fraudulent activity.

The domain was provisioned through the Typedream website‑builder platform, and its authoritative name server entries could not be retrieved (NS_NOT_FOUND), suggesting that the registrar may be obscuring DNS details or that the domain is using a non‑standard configuration. No SSL certificate information, HTTP status codes, or page‑title metadata have been published in the available intelligence, leaving the exact payload delivery mechanism unconfirmed. However, the classification as a “crypto drainer” implies that the site likely attempts to lure victims into transferring cryptocurrency to addresses controlled by the threat actor, a pattern commonly observed in similar campaigns. Defenders should immediately block traffic to desktop‑ledgercom‑live.typedream.app and to its resolved IP 188.114.97.3 at perimeter firewalls and DNS filtering layers.

Continuous monitoring of the IP for any changes in hosting or additional domains sharing the same address is recommended. Adding the domain to internal blocklists, as well as ensuring that endpoint protection solutions are updated with the latest VirusTotal signatures, will reduce exposure. Because the underlying page content and SSL configuration remain unknown, further investigative crawling or sandbox execution is advised to capture any malicious scripts or redirection behavior that may be employed during a crypto‑draining attempt.