dora-live-en-ledger[.]pages[.]dev

Analysis performed on July 29, 2026 identifies dora-live-en-ledger.pages.dev as an active crypto drainer infrastructure. The domain resolves to the IPv4 address 172.66.47.56 and is hosted behind Cloudflare, Inc., as indicated by the registrar and the authoritative nameservers cameron.ns.cloudflare.com and fay.ns.cloudflare.com. Cloudflare’s edge network provides generic TLS termination, but no specific SSL certificate details are available from the current intelligence set. VirusTotal has recorded detections from 11 of 91 scanned security vendors, confirming that multiple independent engines flag the domain as malicious.

The domain is listed on the PhishDestroy blocklist and appears on one additional security blocklist, reinforcing its reputation as a threat vector. The threat classification is a crypto drainer, implying that the site is likely used to solicit cryptocurrency transfers from unsuspecting victims, though the exact phishing page content, page title, and targeted brand have not been disclosed in the available data set. Defenders should incorporate the domain into DNS‑based deny lists, firewall egress controls, and proxy filtering rules to prevent internal users from resolving or connecting to the address. Network monitoring should include alerts on outbound connections to 172.66.47.56 and any HTTP(S) requests containing the domain string.

Because the domain leverages Cloudflare’s CDN, traditional IP‑based blocking may be less effective if the provider reassigns the address; therefore, domain‑level controls are recommended. Continuous re‑evaluation is advised, as further analysis of the landing page, HTTP response codes, and potential credential‑harvesting forms could reveal additional indicators of compromise. Until such deeper inspection is performed, the precautionary stance should remain elevated, with active blocking and logging of all traffic to this host.