link[.]web3-ledgerconnect[.]com

The domain link.web3-ledgerconnect.com is currently active and classified as a high‑risk crypto drainer. HTTP probing returns a 200 status code, indicating that a web service is reachable. The domain is listed on one security blocklist and has been explicitly blocked by the PhishDestroy filtering service, reinforcing its malicious reputation.

Domain name server records resolve to ns5.maskhosting.com and ns6.maskhosting.com, suggesting reliance on the maskhosting.com hosting infrastructure. VirusTotal analysis shows that 14 of 91 security vendors have flagged the domain, providing independent confirmation of malicious activity. Registration details reveal that the domain was created through TuringSign Inc., operating under the trade name Cosmotown, which is a known registrar used by threat actors.

No additional public indicators such as page title, SSL certificate details, or Safe Browsing verdicts are available at this time, leaving the exact content and delivery mechanisms of the crypto‑draining operation unverified. Defenders should continue to block the domain at network perimeters and endpoint filters, monitor DNS queries for the associated nameservers, and consider adding the domain to internal blocklists. Ongoing observation of the hosting provider and any future VirusTotal or threat‑intel updates is recommended to detect potential changes in the threat landscape and to refine remediation actions.