ledger-secure-live[.]wasmer[.]app

The domain ledger-secure-live.wasmer.app is currently active and has been classified as a high‑risk crypto drainer infrastructure. Registration data indicates the domain was provisioned through Wasmer Inc., using the authoritative name servers alpha.ns.wasmernet.com and beta.ns.wasmernet.com. DNS resolution points to the IPv4 address 62.210.172.148, which is the sole host observed for this domain. Dynamic analysis on VirusTotal shows that eight of ninety‑one antivirus or URL‑reputation engines have raised a detection on the domain, suggesting the presence of malicious payloads or phishing indicators.

The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that at least one commercial mitigation platform has incorporated it into its defensive feed. Consequently, the precise phishing landing page, targeted cryptocurrency wallets, or any drop‑per‑site behavior remain unverified. The lack of additional contextual artifacts such as OTX tags, Safe Browsing status, or further blocklist entries means the observable footprint is relatively narrow, but the existing detections are sufficient to warrant immediate defensive action. Defenders should consider adding ledger-secure-live.wasmer.app to DNS‑based deny lists and firewall rule sets, as well as blocking the associated IP address 62.210.172.148 at network edges.

Continuous monitoring of the name servers and the IP range is advised to detect any rapid re‑hosting or domain‑generation activity. Organizations that handle cryptocurrency transactions should increase scrutiny of outbound connections to the domain and apply strict validation of any wallet address inputs that could be intercepted by this infrastructure. Because the domain remains active, threat‑intel platforms should be updated to reflect its high‑risk status and to propagate the indicator to downstream security tools.