ledger-vault[.]io

Analysis of ledger-vault.io, created on May 07, 2026 and registered through PDR Ltd. d/b/a PublicDomainRegistry.com, indicates that the domain is being used as a crypto‑drainer infrastructure. The domain resolves to the IPv4 address 91.92.241.159 and is served by the authoritative nameservers ns1.metaquotes.business and ns2.metaquotes.business. It appears on a single security blocklist and is actively blocked by the PhishDestroy service, confirming that defensive feeds are already flagging the host.

VirusTotal records show that the domain has been scanned by 91 independent vendors; at the time of analysis no vendor raised a detection, though the absence of a flag does not constitute evidence of benign behavior. No public evidence has been recorded for SSL certificate details, HTTP response codes, or page title, and Safe Browsing or Open Threat Exchange (OTX) listings are not currently referenced. The limited visibility of additional threat intelligence suggests that the malicious activity may be recent or low‑profile, but the combination of registrar data, nameserver configuration, and blocklist inclusion aligns with known crypto‑drainer campaigns.

Defenders should add ledger‑vault.io to network and DNS blocklists, monitor outbound connections to 91.92.241.159, and enforce strict controls on cryptocurrency transaction requests. Continuous re‑scanning on multi‑vendor platforms is advised to capture any future payload updates or indicator changes. The domain remains active as of the report date, July 25, 2026, and should be treated as a high‑confidence threat vector pending further investigative findings.