my-ledger-8ff4d[.]firebaseapp[.]com

The domain my-ledger-8ff4d.firebaseapp.com is actively used in a crypto‑drainer campaign and is currently classified as elevated risk. Infrastructure analysis confirms that the hostname resolves to the public address 199.36.158.100. The same IP has been observed in multiple phishing‑related incidents and is listed on two independent security blocklists. Both PhishDestroy and OpenPhish have issued blocks against the domain, indicating that reputable threat‑intel feeds consider the site malicious.

VirusTotal has processed the domain and 12 of 91 scanning engines have raised detections, providing additional corroboration of its abusive nature. No public information is available regarding the site’s SSL configuration, HTTP response codes, or page title, and the content of the landing page has not been documented in the supplied intelligence. Consequently, the precise technique employed to lure victims—such as a fraudulent wallet prompt or a compromised transaction page—remains unverified. Defenders should prioritize immediate containment by adding my-ledger-8ff4d.firebaseapp.com to DNS‑based blocklists and enforcing firewall rules that deny outbound connections to 199.36.158.100.

Continuous monitoring of the IP address for new hostnames or related activity is advisable, as threat actors frequently rotate subdomains while retaining the same hosting infrastructure. Organizations that handle cryptocurrency transactions should also heighten user awareness campaigns, reminding personnel that unsolicited requests to connect a wallet or approve transfers may originate from domains like this. Given the existing detections across multiple vendors and its presence on established blocklists, the domain should be treated as active malicious infrastructure until further forensic evidence indicates its retirement or mitigation.