ledgerlivwallotjikise[.]webflow[.]io

ledgerlivwallotjikise.webflow.io is currently listed as an active crypto‑drainer infrastructure. VirusTotal records show that 15 of 91 scanning engines have generated a detection for the domain, indicating that multiple security products have identified malicious behavior. The domain is present on two public blocklists and is explicitly blocked by the PhishDestroy and OpenPhish feeds, confirming its inclusion in community‑driven phishing mitigation programs. DNS resolution points to 104.18.36.248, an address belonging to the Cloudflare network that is commonly used by Webflow‑hosted sites; the same IP hosts numerous unrelated legitimate sites, which can increase the risk of collateral blocking if a blanket IP block is applied.

No publicly available registration data, SSL certificate details, HTTP response codes, or page title information are supplied in the current intelligence set, so the exact content served by the site remains unverified. The lack of visible page‑level indicators prevents confirmation of the specific payload or credential‑harvesting mechanisms, but the classification as a “crypto drainer” suggests the site is intended to lure victims into transferring cryptocurrency to attacker‑controlled wallets. Defenders should treat the domain as high‑confidence malicious.

Immediate actions include adding ledgerlivwallotjikise.webflow.io to URL filtering policies, enforcing DNS‑based blocklists that already contain the domain, and monitoring outbound connections to 104.18.36.248 for anomalous traffic patterns. Because the IP is shared, consider implementing hostname‑based allowlists for legitimate services that also resolve to the same address to avoid unnecessary disruption. Continuous re‑evaluation is advised as further threat‑intel, such as page content hashes or certificate fingerprints, becomes available.