live-ledger--app.pages.dev — Crypto Drainer Investigation

The domain live-ledger--app.pages.dev is currently classified as a crypto‑drainer threat with an elevated risk rating. Infrastructure analysis shows the domain is hosted on Cloudflare's network, using the authoritative nameservers bayan.ns.cloudflare.com and laura.ns.cloudflare.com and resolving to the IP address 172.66.44.61. Registration details indicate the domain was created through Cloudflare, Inc., a registrar that often shields registrant information, which limits direct attribution of the operators.

VirusTotal has recorded detections from 12 of 91 scanned security vendors, suggesting that multiple independent engines have identified malicious behavior associated with the host. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that defensive communities have observed abusive activity emanating from this address. No public evidence is available regarding SSL/TLS configuration, HTTP response codes, page titles, or content signatures, leaving the exact mechanisms of the crypto‑draining payload unknown.

Consequently, defenders should assume the site is capable of executing unauthorized cryptocurrency transactions or wallet credential harvesting. Recommended mitigations include adding the domain and its resolved IP to network‑level deny lists, configuring DNS sinkholing for the hostname, and monitoring outbound connections to 172.66.44.61 for anomalous traffic patterns. Continuous re‑evaluation of the domain’s detection scores and blocklist status is advised, as changes in the underlying content or hosting could alter the threat posture.