web3ledgerlink[.]com

PhishDestroy identifies web3ledgerlink.com as an active crypto-draining domain weaponized to siphon funds from unwitting cryptocurrency users. The site masquerades as the legitimate Web3Ledger service, luring victims with a plausible wallet login workflow and pre-configured drainer kit designed to harvest seed phrases, private keys, and digital assets. All infrastructure is deployed under the guise of “secure ledger management,” yet the domain contains obfuscated JavaScript payloads that automatically intercept and transfer balances to attacker-controlled wallets upon any user interaction.

This domain was registered through Dynadot Inc on April 25, 2026 and currently resolves to IP 188.114.96.3. VirusTotal shows 0 detections out of 95 engines as of the latest scan, indicating no antivirus or security service has yet flagged the payload. The registrar entry remains publicly accessible with no WHOIS protection, and Google Safe Browsing has not yet blacklisted the domain. PhishDestroy’s telemetry counts zero community reports to date, placing this threat in the initial reconnaissance phase.

At present, web3ledgerlink.com remains live and operational, continuing to propagate via social-media lures and targeted advertisements. Security researchers are urged to block the domain at DNS level and submit additional IOCs to threat-intel feeds to expedite takedown. The current risk is classified as UNDER_INVESTIGATION; while no detections exist in public scanners, the absence of blocks combined with active drainer code represents a HIGH immediate danger to cryptocurrency users. Users should refrain from visiting or approving wallet connections, and instead verify any similar domain against the PhishDestroy database before interacting.