guidee-ledgerlive[.]pages[.]dev

On 29 July 2026 the domain guidee-ledgerlive.pages.dev was identified as part of a crypto‑drainer campaign. The domain is delegated to the Cloudflare name servers louis.ns.cloudflare.com and novalee.ns.cloudflare.com, confirming that the registration and DNS hosting are performed by Cloudflare, Inc. DNS resolution returns the address 188.114.97.3, an IP owned by Cloudflare and frequently used for content delivery and fast‑flux hosting. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy filtering service, indicating that at least one external threat‑intel feed has flagged the host. VirusTotal analysis reports that 10 of 91 scanned security vendors classify the domain as malicious, providing independent corroboration of its threat posture.

No additional data such as page title, SSL certificate details, HTTP status codes, or content snapshots are currently available, so the exact page structure, payload delivery method, and victim interaction flow remain unverified. The lack of broader blocklist coverage suggests limited public exposure, yet the multi‑vendor detection count demonstrates active abuse. Defenders should treat any network traffic to or from guidee-ledgerlive.pages.dev as suspicious.

Recommended mitigations include blocking the domain at perimeter firewalls, DNS resolvers, and endpoint protection solutions, as well as adding the associated IP address 188.114.97.3 to deny lists. Continuous monitoring for outbound connections to this IP and for DNS queries for the domain is advised. Incident response teams should collect logs that reference the domain for deeper forensic examination, and security awareness communications should warn users that unsolicited requests to interact with cryptocurrency wallets originating from this host are likely malicious.