ledgerlie[.]pages[.]dev

ledgerlie.pages.dev was created on 26 September 2025 and is hosted on Cloudflare Pages, a service that provides CDN‑backed static site hosting. The domain has been added to one public security blocklist and is actively blocked by the PhishDestroy filtering system. VirusTotal reports that 14 out of 91 scanning engines have flagged the domain as malicious, indicating a moderate level of consensus among antivirus and URL reputation services. The threat category associated with the domain is a crypto drainer, a type of campaign that attempts to lure victims into transferring cryptocurrency assets to attacker‑controlled wallets.

No public SSL certificate details, IP address, or HTTP response codes have been disclosed in the available intelligence, so the underlying server location and TLS posture remain unknown. The limited visibility of the site’s content—no page title or brand information has been released—prevents a more granular assessment of the lure used in the campaign. Defenders should treat any unsolicited communication that references ledgerlie.pages.dev as potentially hostile, especially if it includes requests to sign transactions, approve wallet connections, or provide private keys. Network‑level controls such as DNS sinkholing or blocking the domain at perimeter firewalls can reduce exposure.

Endpoint protection products that incorporate the VirusTotal detection data should be configured to quarantine or alert on connections to the domain. Continuous monitoring of the domain’s reputation on additional blocklists and periodic re‑scanning with VirusTotal are recommended to capture any changes in detection rates. Organizations that handle cryptocurrency transactions should enforce strict verification procedures, educate users about unsolicited crypto‑related requests, and isolate wallet operations from general web browsing to mitigate the risk posed by this active crypto‑drainer infrastructure.