ledger-com-start[.]cc

Analysis of the domain ledger-com-start.cc, observed on 2026-08-02, indicates that it is being used in a crypto-drainer campaign targeting cryptocurrency wallet users. The domain resolves to the IPv4 address 172.67.135.70, a host that is part of a content-delivery network frequently leveraged by threat actors for fast-flux style hosting. VirusTotal records show that four out of ninety-one scanning engines have flagged the domain as malicious, providing independent confirmation of its abusive nature.

The domain is listed on three external blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services, demonstrating that multiple defensive platforms have identified it as a source of malicious activity. Publicly available intelligence does not disclose the registrar, creation date, SSL certificate details, or the exact page title served by the site, leaving the full scope of its infrastructure and content unverified. The limited detection footprint suggests a relatively recent deployment, but the presence on multiple blocklists implies that the campaign is already in circulation.

Defenders should prioritize adding ledger-com-start.cc to deny-list rules across DNS resolvers, proxy filters, and endpoint firewalls. Organizations that manage cryptocurrency wallets should enforce strict URL allow-lists and consider disabling automatic transaction approvals in wallet software to mitigate automated draining attempts. Continuous monitoring of the associated IP address and any future VirusTotal submissions is recommended to capture potential changes in the threat profile.