# PhishDestroy threat dossier — ledger-haven.com ================================================================ Fetched: 2026-07-27 12:29:39 UTC Canonical: https://phishdestroy.io/domain/ledger-haven.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Crypto Drainer Targeted brand: Ledger ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 16/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Lionic, Netcraft, Sophos, VIPRE, Webroot AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 5.182.208.207 (NL, Amsterdam) ASN: AS62068 SpectraIP B.V. Hosting org: SpectraIP B.V. Registrar: Global Domain Group LLC Nameservers: ns5.maskhosting.com, ns6.maskhosting.com Registered: 2025-08-31 Expires: 2026-08-31 Page title: Home - Ledger Haven Limited HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-10-10 Status: INVALID chain Fingerprint: cedd9f858305b6d0f788d2dceefccddff84cb848eb03eddb592f3b5ef42301c8 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-08-31 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-27 09:25:16 UTC (by PhishDestroy tracker) First reported: 2026-07-27 11:31:41 UTC (abuse notice filed) Last verified: 2026-07-27 13:45:12 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fa283-4ec4-708c-b5d1-def8b0d9d72f/ URLQuery: https://urlquery.net/report/37d7a3ae-961b-439e-8782-3ac2d58da38f Wayback Machine: https://web.archive.org/web/*/ledger-haven.com crt.sh CT logs: https://crt.sh/?q=%25.ledger-haven.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=ledger-haven.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/ledger-haven.com URLhaus: https://urlhaus.abuse.ch/host/ledger-haven.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 09:26:19 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] ledger-haven.com — Crypto Drainer Investigation Report The domain ledger-haven.com was registered on August 31, 2025 through Global Domain Group LLC and is currently hosted on the IP address 5.182.208.207. Its authoritative name servers are ns5.maskhosting.com and ns6.maskhosting.com, indicating use of the MaskHosting service. VirusTotal reports that sixteen of ninety‑one antivirus and URL scanning engines flag the domain as malicious, which aligns with its classification as a crypto‑drainer by the reporting team. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that defensive feeds have recognized it as a threat. The infrastructure is still live as of the report date, July 27, 2026, and the threat is rated high due to its potential to siphon cryptocurrency assets from unsuspecting victims. While the public-facing web content has not been analysed in this brief, the observable network indicators alone merit immediate mitigation. Defenders should add ledger‑haven.com and its resolving IP 5.182.208.207 to network deny lists, enforce DNS sink‑hole rules, and ensure that endpoint protection suites incorporate the latest VirusTotal signatures that include the sixteen detections. Continuous monitoring of the associated name servers is advised, as they may be leveraged for additional malicious domains. Organizations that handle cryptocurrency transactions should treat any inbound traffic from this domain as hostile and quarantine related email or web requests pending further investigation. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260727-C82D38 Favicon MD5: fb78a3d253a65d5305e9a6b3bd657cc0 TLS cert SHA-256: cedd9f858305b6d0f788d2dceefccddff84cb848eb03eddb592f3b5ef42301c8 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/ledger-haven.com/ JSON API: https://api.destroy.tools/v1/check?domain=ledger-haven.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 205,040 domains (80,212 alive under monitoring, 123,797 confirmed takedowns/dead). Site: https://phishdestroy.io