ledger-live-wellt[.]pages[.]dev

ledger-live-wellt.pages.dev is currently flagged as an active crypto‑drainer with an elevated risk rating. The domain is registered through Cloudflare, Inc. and uses the Cloudflare nameservers joan.ns.cloudflare.com and yew.ns.cloudflare.com. DNS resolution points to the IP address 172.66.44.191, which is part of Cloudflare’s edge network and therefore does not reveal a dedicated backend host. VirusTotal has recorded 11 of 91 security vendors flagging the domain, indicating that multiple independent scanners have identified malicious behavior.

The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one commercial threat‑intel feed treats it as hostile. No public information is available regarding SSL certificate details, HTTP response codes, page title, or any observed traffic patterns, so the exact delivery mechanism of the crypto‑draining payload remains uncertain. Infrastructure analysis suggests the attacker is leveraging Cloudflare’s CDN to hide the true origin server and to benefit from the platform’s global reach. Defenders should immediately add the domain to DNS‑based deny lists and block any outbound connections to 172.66.44.191 at the network perimeter.

Endpoint protection solutions should be updated to include the 11 vendor detections reported by VirusTotal, and security monitoring should watch for attempts to contact the domain or its IP address. Because the site is classified as a crypto‑drainer, any credential or wallet address submissions intercepted from this domain could result in unauthorized fund transfers. Continuous re‑evaluation is recommended as additional intelligence may surface regarding the payload, hosting details, or associated command‑and‑control infrastructure.