web3ledgermetrics[.]com

Analysis of web3ledgermetrics.com as of July 27, 2026 indicates that the domain is actively used in a crypto‑drainer campaign. The domain was registered on May 05, 2026 through Realtime Register B.V. and is served by three authoritative name servers (luna.mydnsvault.com, neon.mydnsvault.com, odin.mydnsvault.com). DNS resolution points to the IPv4 address 103.191.208.56, which is the sole hosting endpoint observed for the infrastructure.

VirusTotal has recorded two positive detections out of ninety‑one scanned security vendors, confirming that at least a subset of scanners recognize malicious behavior associated with this host. The domain is presently listed on one public security blocklist and is actively blocked by the PhishDestroy mitigation service, further corroborating its malicious status. No additional public intelligence such as Google Safe Browsing, OTX pulse, or SSL certificate details were provided, leaving gaps in the full threat profile.

Defenders should consider adding web3ledgermetrics.com to internal blocklists, enforce DNS sinkholing for its IP address, and monitor traffic to the associated name servers for potential command‑and‑control activity. Ongoing observation of the IP 103.191.208.56 for new payload deliveries or credential harvesting attempts is recommended, as is periodic re‑scanning with multi‑engine services to capture any evolution in the malicious payload. The limited detection footprint (two vendors) suggests that the campaign may be employing evasion techniques, so proactive network‑level controls remain essential until the infrastructure is fully dismantled.