ledgerhound[.]vip

PhishDestroy identifies ledgerhound.vip as an active crypto drainer impersonating the legitimate LedgerHound brand, which provides crypto-asset tracing and blockchain forensics services. The domain was registered on March 31, 2026, through Dynadot Inc. and resolves to IP 216.198.79.1. While the page title closely mirrors the real LedgerHound service, the site is not affiliated with Ledger and is actively pushing malicious drainer scripts designed to siphon cryptocurrency from unwitting users. The threat actor behind this site is leveraging brand confusion and SEO manipulation to attract victims searching for legitimate blockchain investigation tools.

Technical analysis reveals that ledgerhound.vip currently has a clean VirusTotal score of 1 out of 95 detections and is not flagged on Google Safe Browsing (GSB). The domain is not widely blocked across major threat intelligence feeds, suggesting it may be in an early deployment phase. Its SSL certificate is issued by Let’s Encrypt, a common choice for malicious sites seeking to appear legitimate. Despite a clean VT score, behavioral analysis confirms the presence of a crypto-draining kit linked to a known seed (dc31ac), indicating this is a live threat with evolving infrastructure.

This domain remains under active investigation by PhishDestroy, with a current risk level classified as "under_investigation." No mass-blocking action has been taken by major browsers or security vendors yet, but real-time monitoring is ongoing. Users are strongly advised to avoid interacting with ledgerhound.vip and to verify any blockchain forensics-related websites directly through official Ledger channels. The risk of financial loss remains elevated due to the site’s active status and lack of widespread detection.